Performance of syslog-ng on the original Raspberry Pi was not outstanding, the peak I could reach was at about 6500 messages per second, as I wrote it in my blog in 2013.
So I was curious, how the Raspberry Pi 2, with a four-core ARMv7 CPU and double RAM performs. I did a quick test and got the “wow” effect: 59000 msg/s peak and 43000 msg/s sustained message collection.
Testing
I have measured its performance in an ideal environment: 10 TCP clients, all messages 200 bytes long, no PatternDB. However, in some cases, it is not possible to utilize all four cores, for example when using PatternDB, when having a single log source, or when transferring messages through the UDP protocol. Still, with the ¼ of these values, you can still reach a performance around 10000 messages per second. Enabling encryption usually also has a performance effect, limiting speed to the 1/3 of the original speed in my experience. Comparing this value with 100 msg/s, the average message rate reported by syslog-ng users in bug reports and forum discussions still demonstrates that using syslog-ng on Raspberri Pi 2 can be a great solution for most use cases.
Conclusion
Of course, this is just storing messages into flat files. This is great for archival or if you do not have to look at your logs often. For the rest, a more powerful machine with a database and a GUI is recommended: https://www.syslog-ng.com/community/b/blog/posts/web-interfaces-for-your-syslog-server-an-overview If you still want to use ARM, here is what I found recently: Picocluster. Currently it is a cluster of Raspberry Pi 2 machines, but soon it will be also available with ARMv8 (64bit ARM) for even better performance, using Pine64 boards.
