Getting Top Performance out of rsyslog

Rsyslog is lightning fast. However, the configuration influences speed very much. This blog post tells what offers optimal performance for the most recent v5 version.

I will update this blog post whenever there is news to share (at least this is the plan). This information will also hopefully flow into the rsyslog doc at some time.

• do not use more than one ruleset within a single queue
  
• do not use rate limiting unless absolutely necessary
  
• use array-based queue modes
  
• do not use
  
• send data from different inputs to multiple queues
  
• use "$ActionWriteAllMarkMessages on" for all actions where you can afford it (it really makes a difference!)
  

This following blogpost also has some solid information on performance-influencing parameters: rsyslog evaluation. Note that it talks about a somewhat older rsyslog release. While already quoting 250,000 messages per second, rsyslog 5.5.6 is quite a bit faster.