How much log traffic can syslog-ng handle?

This depends on the configuration of syslog-ng, the hardware running syslog-ng, and the exact situation and environment. The limits of the throughput of syslog-ng are similar to the limits of other network applications. When sizing the hardware required for syslog-ng, try to estimate the log traffic to be processed and the filtering complexity to be applied.

The main limiting factors are the following:

  • Network bandwith
  • Disk I/O
  • CPU (only in you have complex filtering setup)

Other limiting factors are:

  • SSL, as it is very CPU intensive
  • database destinations, as due to their complexity they can handle a lot less traffic than plain text files

Additional information

For more details, check syslog-ng pe v5.0 performance whitepaper!