Vector's Single-Threaded UDP Bottleneck: Scaling to 75k syslog messages/sec with rsyslog Fan-Out

Mon, 05 Oct 2026 00:00:00 +0000

Introduction

A handful of our firewalls and NVAs were emitting around 35,000 syslog messages per second. At roughly 1,100 bytes per message that is ~38 MB/s of UDP, and every single packet was landing on one core of an 8 vCPU VM. Vector was pinning a vCPU at 100%, the kernel’s UDP receive buffer was overflowing, and UdpRcvbufErrors was climbing. Messages were being dropped before Vector ever saw them.

The root cause is not a bug. Vector’s socket (UDP) and syslog (UDP) sources are single-threaded: all packets enter one queue and are processed sequentially by one receive loop. This is documented behaviour, and it has been discussed at length in vectordotdev/vector#22132 . You can throw 16 cores at Vector and it will still saturate at the same per-core ceiling, because the UDP receive path itself — not the pipeline — is the bottleneck.

Load-Balancer on Harshanu

Vector's Single-Threaded UDP Bottleneck: Scaling to 75k syslog messages/sec with rsyslog Fan-Out

Introduction