hardware requirements per hits

[Subhan Malick]

On 8/17/09 10:15 PM, Fajar A. Nugraha wrote:
> Here are some pointers from my experience though:
> - syslog query logging is expensive. NEVER enable it. If you need to
> log client queries, log it directly to file instead.

I would like to hear more about why this is so. We are currently 
debating sending query logs to a remote syslog server to enhance some 
security tools. We are running BIND 9.6.1-P1 with multithreading enabled 
on RHEL 4 (2 dual-core 2.8 GHz Opterons with 1MB cache, 4G of RAM). I 
have run some tests and while there is some queries/sec hit, the RTTs 
are not terrible.

---------------------------------------------------------------------

queryperf -d input/queries.log.34 -s hidden.server -q 200 -l 300 -b 32
running 9.6.1-P1 with querylogging on and directed to remote syslog

Statistics:

   Parse input file:     multiple times
   Run time limit:       300 seconds
   Ran through file:     0 times

   Queries sent:         746189 queries
   Queries completed:    739501 queries
   Queries lost:         6688 queries
   Queries delayed(?):   0 queries

   RTT max:             5.003000 sec
   RTT min:              0.000197 sec
   RTT average:          0.036471 sec
   RTT std deviation:    0.204566 sec
   RTT out of range:     1 queries

   Percentage completed:  99.10%
   Percentage lost:        0.90%

   Started at:           Tue Aug 18 11:22:50 2009
   Finished at:          Tue Aug 18 11:27:55 2009
   Ran for:              304.900344 seconds

   Queries per second:   2425.385916 qps

---------------------------------------------------------------------

cache flushed
queryperf -d input/queries.log.34 -s hidden.server -q 200 -l 300 -b 32
running 9.6.1-P1 with querylogging on and directed to local disk

Statistics:

   Parse input file:     multiple times
   Run time limit:       300 seconds
   Ran through file:     0 times

   Queries sent:         982436 queries
   Queries completed:    973645 queries
   Queries lost:         8791 queries
   Queries delayed(?):   0 queries

   RTT max:             4.999350 sec
   RTT min:              0.000219 sec
   RTT average:          0.016778 sec
   RTT std deviation:    0.152307 sec
   RTT out of range:     0 queries

   Percentage completed:  99.11%
   Percentage lost:        0.89%

   Started at:           Tue Aug 18 11:29:08 2009
   Finished at:          Tue Aug 18 11:34:13 2009
   Ran for:              304.979150 seconds

   Queries per second:   3192.496930 qps

---------------------------------------------------------------------

cache flushed
queryperf -d input/queries.log.34 -s hidden.server -q 200 -l 300 -b 32
running 9.6.1-P1 with querylogging off

Statistics:

   Parse input file:     multiple times
   Run time limit:       300 seconds
   Ran through file:     0 times

   Queries sent:         1027578 queries
   Queries completed:    1018243 queries
   Queries lost:         9335 queries
   Queries delayed(?):   0 queries

   RTT max:             5.043680 sec
   RTT min:              0.000008 sec
   RTT average:          0.013455 sec
   RTT std deviation:    0.142308 sec
   RTT out of range:     1 queries

   Percentage completed:  99.09%
   Percentage lost:        0.91%

   Started at:           Tue Aug 18 11:35:27 2009
   Finished at:          Tue Aug 18 11:40:32 2009
   Ran for:              304.932400 seconds

   Queries per second:   3339.241747 qps

---------------------------------------------------------------------

This server is a caching-forwarder with max-cache-ttl (and 
max-ncache-ttl) set to 15 mins. It has 4G of memory with no limit 
enforced in named.conf.

version: 9.6.1-P1
CPUs found: 4
worker threads: 4
number of zones: 12
debug level: 0
xfers running: 0
xfers deferred: 0
soa queries in progress: 0
query logging is ON
recursive clients: 0/5900/6000
tcp clients: 0/100
server is up and running