Advertisement
If you have a new account but are having problems posting or verifying your account, please email us on hello@boards.ie for help. Thanks :)
Hello all! Please ensure that you are posting a new thread or question in the appropriate forum. The Feedback forum is overwhelmed with questions that are having to be moved elsewhere. If you need help to verify your account contact hello@boards.ie

Cacti, Nagios, Syslog - all on one box?

Options
  • 16-01-2007 1:29pm
    #1
    po0k
    Registered Users Posts: 15,815 ✭✭✭✭


    Looking at getting a dual Xeon 5140 (4x 2.33Ghz cores in total), 4GB ram, 2x 73GB 15Krpm SAS in RAID1, and migrating our [currently seperate] nagios and cacti installs to this machine.
    Network has about 500 devices and approx 50 servers in a tiered topology (core, distribution, access).
    I'd like to implement a syslog collector - specifically syslog-ng+MySQL+PHP Web interface - but I have concerns over performance, particularly losing syslog messages during nagios or cacti's polling periods (every 5 minutes), and scaling.

    Initially syslog won't be utilised on more than the core network infrastructure, but we already see quite a bit of traffic from our PIX.

    I'm worried about the load on MySQL though, syslog, nagios and cacti will all be utilising it, with the majority of action happening every 5 minutes (or half every 2.5mins if I fiddle with cron).


Comments

  • Options
    #2
    nickhilliard
    Registered Users Posts: 57 ✭✭nickhilliard


    SyxPak wrote:
    but I have concerns over performance, particularly losing syslog messages during nagios or cacti's polling periods (every 5 minutes), and scaling.
    I'd strongly suggest that you use cactid, if you're not using it already. Some testing I did about 9 months ago indicated that it completes a poll cycle about 80-100 times faster than poller.php with far less in the way of resource utilisation. Sounds like your setup requires this level of optimisation.

    syslog requires very little in the way of resources, unless you're running it in synchronous mode (i.e. fsync after every message). It's been too long since I've used syslog-ng, but certainly bsd syslog is very resource efficient.

    If you find that disk access is a problem, you should consider moving to raid 0 or raid 0+1. With your current setup, spindle speed could become an issue, if you find that nagios is really chewing things up.

    other than that, i'd be surprised if you had trouble with this configuration. Just make sure to bump up your mysql resource limits so that your SQL databases can be cached in ram properly, so that you're not constantly hitting the disks.

    Nick


  • Options
    #3
    po0k
    Registered Users Posts: 15,815 ✭✭✭✭po0k


    That's what I was thinking.

    I've got a nice tidy cacti setup (based on 0.8.6h/ubuntu) with cactid, just need to enable LDAP auth back to our Netware boxen.

    I was planning to let syslog log to both text file(s) (maybe filtering down to just critical messages) so that we'd still have something to tail, and mysqldb, accessed and searched via a web interface.

    I haven't done much MySQL tuning, upped the memory limit for php for cacti back when it was using poller.php.

    The think that made me worried was our PIX (main box I'm looking to syslog to begin with) throwing out ~100msg/sec.

    Chassis can only take 2 disks, if I/O is a problem, SAN attachment is an option I guess.


Advertisement