The performance of syslog depends heavily on what implementation you are using. For example, rsyslog has been measured at 1M logs/sec under ideal conditions (and I've used it at over 100K logs/sec). rsyslog is now the default syslog on just about every linux distro. This isn't like the old sysklogd that was could only process one message at a time and blocked everything until it finished processing the message (limiting it to a few hundred logs/sec, even on really good disks)

I can understand why you would not want to make logging to syslog be the default, but why are you so opposed to having it as an option?

yes, if the syslog daemon dies, things writing to it will block, but if your partition that you are writing logfiles to fills up you will block as well. Deciding how to log, and if blocking on another daemon is acceptable should be up to the system administrator. Sometimes getting a copy of the logs elsewhere in near real-time is worth reducing the peak requests/sec that a box can handle

The other approach you could allow someone to submit would be to sent the logs out in real-time via UDP, this will mean that logs are lost if the syslog daemon goes down, but nginx won't block

David Lang