Rsyslog is lightning fast. However, the configuration influences speed very much. This blog post tells what offers optimal performance for the most recent v5 version.
I will update this blog post whenever there is news to share (at least this is the plan). This information will also hopefully flow into the rsyslog doc at some time.
- do not use more than one ruleset within a single queue
- do not use rate limiting unless absolutely necessary
- use array-based queue modes
- do not use
- send data from different inputs to multiple queues
- use “$ActionWriteAllMarkMessages on” for all actions where you can afford it (it really makes a difference!)
This following blogpost also has some solid information on performance-influencing parameters: rsyslog evaluation. Note that it talks about a somewhat older rsyslog release. While already quoting 250,000 messages per second, rsyslog 5.5.6 is quite a bit faster.