This depends on the configuration of syslog-ng, the hardware running syslog-ng, and the exact situation and environment. The limits of the throughput of syslog-ng are similar to the limits of other network applications. When sizing the hardware required for syslog-ng, try to estimate the log traffic to be processed and the filtering complexity to be applied.
The main limiting factors are the following:
- Network bandwith
- Disk I/O
- CPU (only in you have complex filtering setup)
Other limiting factors are:
- SSL, as it is very CPU intensive
- database destinations, as due to their complexity they can handle a lot less traffic than plain text files
For more details, check syslog-ng pe v5.0 performance whitepaper!