We have an two important applications on a CentOS box - one is Syslog, which is using UDP port 514. The other is bind (DNS), using UDP port 53.

Is there a tuning mechanism that can be used to give higher internal priority to the syslog traffic, so that unprocessed DNS lookup request might disappear from any networking buffer BEFORE the syslog traffic (which we only have one shot at getting).

Moving the syslog traffic from UDP to TCP isn't an option here, since the device vendor decided UDP syslog was "perfectly adequate"..

  • Although I don't think it makes much sense, the actual solution would be to increase the Syslog process' priority so it empties its queue faster. – Julie Pelletier Jul 13 '16 at 15:29
  • and/or renice the bind process to have lower priority – Jeff Schaller Jul 13 '16 at 15:34
  • Depending on your DNS setup, it could not be the brightest of the ideas - DNS is the bread and butter of all services. Send Syslog as TCP would be the better option. Nevertheless your post is not clear. Do you need to protect better your DNS server ; if high CPU optimize your configs. Is the DNS load so high? DNS has usually a low footprint. Syslog and DNS while UDP, work relatively well over a private network. Are you making castles out of thin air? Is your DNS infra-structure need a redesign? e.g. you need to substantiate better with backing up data what is really worrying you. – Rui F Ribeiro Jul 13 '16 at 16:11
  • You can use cgroups to classify the syslog traffic and then use a traffic shaper like tc to give priority to syslog. But usually if you're dropping workload traffic that's sign that buffers need to be increased or the speed of workload needs to be increased (performance tuning, adding capacity, etc). – Bratchley Jul 13 '16 at 16:13
  • Thanks for the tips. The box primarily provides syslog service, so I want to ensure that traffic for that service has as close to unconditional priority as I can configure. Using cgroups make sense. It is rarely the case that DNS will overwhelm the machine, but I can limit its CPU affinity to only allow it a limited number of CPUs, I'm looking for a comparable way to limit the amount of network buffers (which are already maxed out) that DNS (UDP port 53) can utilize, compared to Syslog traffic on UDP port 514. – Ralph H Jul 26 '16 at 21:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.