Syslog kills Postfix performance

This night, some scriptkiddie decided it'd be fun to overload one of my servers by bruteforcing the FTP. The FTP server taking 90% of the CPU made the whole server slow. Especially the Postfix mailserver experienced a huge delay.

Anyway, I just firewalled out the scriptkiddie and Postfix could start processing the queue. But for some reason, it delivered no more than 5-10 mails a second. That would mean that processing the queue of 18.000 mails would take 30-60 minutes.

I've tried to figure out why Postfix was so slow before. Without any luck. Using the well known tuning pages didn't help me at all. Today, I opened up /usr/bin/top, to see that the system was doing a lot of I/O. I accidently found out why: I like to have syslog write *.* to /var/log/allmessages.

This simple rule caused so much extra I/O, that postfix was slowed down 90%. After disabling "allmessages" performance went up, and the queue was processed within minutes. Makes me wonder what happens if I...

  • disable logging at all, which is a bad idea as you can no longer spot abuse
  • find a way to enable write-cache - the default syslog of CentOS 5 does not support this AFAIK
  • write logs to another device

Interesting...

© GeekLabInfo Syslog kills Postfix performance is a post from GeekLab.info. You are free to copy materials from GeekLab.info, but you are required to link back to http://www.geeklab.info

1 Star2 Stars3 Stars4 Stars5 Stars (No Ratings Yet)
Loading...