Logging to syslog

[sthaug at nethelp.no]

> > What exactly does "slow down" mean here? Are you missing messages in
> > the log files? Or are requests not answered in a timely fashion?
> >
> 
> "slow down" means an increment in the time consumed by bind to answer a
> query.
> "heavy load" means about 20 millions query / day per machine, with peaks of
> about 400 query / second.

I'm afraid 400 q/s would be characterized as a *light load* in most
cases. However, if you want query logging bind may not be the best
choice. Using a packet sniffer based solution (tcpdump, dnscap etc)
often works better for higher query loads.

We have successfully used this for query logging at 30k q/s with no
problems whatsoever. As far as I know others have used it for much
higher query loads.

Steinar Haug, Nethelp consulting, sthaug at nethelp.no