syslog-ng: баланс производительности и контроль нагрузки на входе

Нет времени на подробное описание, но в двух словах:

1. На каждом ДЦ по 2 лог-сервера, все пишут на оба.
2. С них инфа идет на GRAYLOG (кластер) для доступа разработчиков и прочих, кому положено (лог-серверы для всех, кроме админов, закрыты).
3. реальный /etc/rsyslog.conf:

$ModLoad immark     # provides --MARK-- message capability
$ModLoad imuxsock   # provides support for local system logging (e.g. via logger command)
$ModLoad imklog     # kernel logging (formerly provided by rklogd)
$AddUnixListenSocket /var/lib/named/dev/log
$AddUnixListenSocket /chroot/dhcp/dev/log
$ActionSendUDPRebindInterval 20
module(load="mmexternal")
action(type="mmexternal"
binary="/usr/local/bin/external_python_cards_replace.py"
interface.input="msg" )
authpriv.*                                              /var/log/secure
auth.*                                                  /var/log/messages
syslog.debug                                            /var/log/rsyslog-stats
$ModLoad imtcp
$InputTCPMaxListeners 20
$InputTCPServerRun 514
$ModLoad imudp  # provides UDP syslog reception
$UDPServerRun 514 # start a UDP syslog server at standard port 514
$template DailyPerHostLogs,"/var/log/cluster/%syslogfacility-text%/%HOSTNAME%/%$YEAR%.%$MONTH%.%$DAY%.log"
$template DailyAggregateLogs,"/var/log/cluster/%syslogfacility-text%/All/%$YEAR%.%$MONTH%.%$DAY%.log"
$template logFormat,"%timegenerated% %HOSTNAME% %PRI-text% %syslogtag%%msg:::drop-last-lf%\n"
$template MalformedMsgFormatter,"%timegenerated% %FROMHOST% %rawmsg:::drop-last-lf%\n"
$template MalformedMsgDailyPerHostLogs,"/var/log/cluster/%syslogfacility-text%/%FROMHOST%/%$YEAR%.%$MONTH%.%$DAY%.log"
$template MalformedMsgDailyAggregateLogs,"/var/log/cluster/%syslogfacility-text%/All/%$YEAR%.%$MONTH%.%$DAY%.log"
local4.* -?MalformedMsgDailyPerHostLogs;MalformedMsgFormatter
local4.* -?MalformedMsgDailyAggregateLogs;MalformedMsgFormatter
auth.*  -?DailyPerHostLogs;logFormat
auth.*  -?DailyAggregateLogs;logFormat
authpriv.*  -?DailyPerHostLogs;logFormat
authpriv.*  -?DailyAggregateLogs;logFormat
cron.*  -?DailyPerHostLogs;logFormat
cron.*  -?DailyAggregateLogs;logFormat
daemon.*  -?DailyPerHostLogs;logFormat
daemon.*  -?DailyAggregateLogs;logFormat
kern.*  -?DailyPerHostLogs;logFormat
kern.*  -?DailyAggregateLogs;logFormat
local0.*  -?DailyPerHostLogs;logFormat
local0.*  -?DailyAggregateLogs;logFormat
local1.*  -?DailyPerHostLogs;logFormat
local1.*  -?DailyAggregateLogs;logFormat
local2.*  -?DailyPerHostLogs;logFormat
local2.*  -?DailyAggregateLogs;logFormat
local3.*  -?DailyPerHostLogs;logFormat
local3.*  -?DailyAggregateLogs;logFormat
local5.*  -?DailyPerHostLogs;logFormat
local5.*  -?DailyAggregateLogs;logFormat
local6.*  -?DailyPerHostLogs;logFormat
local6.*  -?DailyAggregateLogs;logFormat
local7.*  -?DailyPerHostLogs;logFormat
local7.*  -?DailyAggregateLogs;logFormat
mail.*  -?DailyPerHostLogs;logFormat
mail.*  -?DailyAggregateLogs;logFormat
syslog.*  -?DailyPerHostLogs;logFormat
syslog.*  -?DailyAggregateLogs;logFormat
user.*  -?DailyPerHostLogs;logFormat
user.*  -?DailyAggregateLogs;logFormat
$template GRAYLOGRFC5424,"<%pri%> %timestamp:::date-rfc3339% %fromhost% %APP-NAME% %PROCID% %MSGID% %STRUCTURED-DATA% %msg:::drop-last-lf%"
template(name="gelf" type="list") {
    constant(value="{\"version\":\"1.1\",")
    constant(value="\"syslogfacility\":\"")
    property(name="syslogfacility-text")
    constant(value="\",\"host\":\"")
    property(name="hostname")
    constant(value="\",\"short_message\":\"")
    property(name="msg" format="json")
    constant(value="\",\"timestamp\":\"")
    property(name="timegenerated" dateformat="unixtimestamp")
    constant(value="\",\"level\":\"")
    property(name="syslogseverity")
    constant(value="\"}")
}
if $syslogfacility-text == 'local3' then action(type="omfwd" target="graylog-web.int.dc4.local" port="5555" protocol="udp" template="gelf" RebindInterval="100")
if $syslogfacility-text == 'local5' then action(type="omfwd" target="graylog-web.int.dc4.local" port="5556" protocol="udp" template="gelf" RebindInterval="100")
if $syslogfacility-text == 'mail' then action(type="omfwd" target="graylog-web.int.dc4.local" port="5557" protocol="udp" template="gelf" RebindInterval="100")
if $syslogfacility-text == 'local7' then action(type="omfwd" target="graylog-web.int.dc4.local" port="5558" protocol="udp" template="gelf" RebindInterval="100")
if $syslogfacility-text == 'user' then action(type="omfwd" target="graylog-web.int.dc4.local" port="5560" protocol="udp" template="gelf" RebindInterval="100")
$PreserveFQDN on