Re: [gentoo-user] Syslog-ng using a spectacular amount of CPU time... (I'm using sshguard)

[Alan McKinnon <alan.mckinnon@gmail.com>]

On Monday 23 March 2009 21:27:15 Steve wrote:
> Steve wrote:
> >> destination sshguardproc {
> >>     program("/usr/local/sbin/sshguard"
> >>         template("$DATE $FULLHOST $MESSAGE\n"));
> >>     };
>
> The presence of the above line is definitely what triggers the excessive
> CPU usage - it is almost as-if syslog-ng is 'busy-waiting' for the
> sshguard process.  The sshguard process is running - but using zero CPU.
>
> I have this problem with syslog-ng versions 2.1.3 and 2.1.4 (the one
> with ~x86)...
>
> This is very frustrating... having played around, the syslog-ng tends
> towards using 100% CPU when my server is otherwise quiet - if, and only
> if, I have the program destination... even if the destination is not used.

One word:

blocking

I find this is usually the cause for higher than normal CPU load as reported 
by top and other tools. If the load is pegged at exactly 100%, it's almost a 
sure sign that some process is IO blocking on an idle system, and all the 
process is doing is checking if IO is available, see it isn't, goes to sleep, 
wakes up, rinse and repeat.

In short: top lies, and load does not mean what most people think it means. 
The correct definition is "average number of processes that are waiting for 
cpu time within the measurement period." 

-- 
alan dot mckinnon at gmail dot com