Submit a ticketCall us

WebinarUpcoming Webinar: Easily Automate Backups and Simplify Log Message Management

Backing up your network configuration and logging data are a few steps to helping keep your network safe. In this in-depth webinar, we’ll show you how these tasks can be automated to save your IT team time while maintaining accurate archives of your data.

Register now.

Home > Success Center > Log & Event Manager (LEM) > LEM - Knowledgebase Articles > How reservations work on LEM

How reservations work on LEM

Table of contents

Updated January 3, 2017

Overview

This article provides a simplified explanation of how reservations work on LEM. For a  more technical explanation on reservations, please review the following article: Reason for LEM Reservations

Detail

In this article there is a breakdown of what the LEM must have set up by default in order to work. 

 

Resources Necessary for Interface Functionality and Recording Event Data

The level of auditing set in your network environment can be referred to as the flow of event data. That flow of event data is being directed at the LEM Appliance from all of the nodes connecting to it. As you add machines to the LEM from your environment for the purpose of capturing their logs and as you make adjustments to the Audit Policies in your environment, if the load is too high for your CPU and Memory Reservations, it can create performance issues on the LEM Appliance.

 

LEM  CPU and Memory Reservations

The reservation values in the documents listed here are estimates. Though a system may work given default reservations, there are many other factors that could come into play based on the hypervisor's hardware and the network environment that the LEM has been set up in. vSphere or Hyper-V are the only two supported Hypervisors at this time. Any estimation on this page for sizing or for configuring settings that are being given to the LEM Virtual Machine will not constitute a baseline but is an estimation based on our default reservations mentioned in this article. The hardware in your particular environment can be different than our test scenarios, and it is not possible for us to know whether or not a system will absolutely work without being able to test that particular set of hardware devices. Please take this into consideration as you review the following information.

 

Hardware Disk Speeds (IOPS)

Setting up the LEM Virtual Machine in an environment with insufficient IOPS (under 100 MB/s) will cause the LEM to have issues operating and dealing with incoming event data as well as recording that data to the database and can also affect Rules, Queries (nDepth Searches and Reports), or WebConsole interface functionality. 

 

Here are some of our arbitrary IOPS numbers to understand IOPS in relation to event numbers being sent to LEM. As you review these numbers, it's important to note that they can fluctuate higher or lower based on the hardware and software involved in running the LEM Appliance on the Host Machine where the LEM Virtual Machine has been deployed:
 

< 20 MB / sec: is an unacceptable IOPS level, and the Virtual Machine must have faster storage access to work

30 MB/sec to 100MB/sec: can probably handle up to around 15 million events/day, but speed is still marginal

100 MB/sec to 200MB/sec: can probably handle up to around 30 million events/day

200 MB/sec to 300MB/sec: can probably handle up to around 60 million events/day

300 MB/sec to 400MB/sec: can probably handle up to around 120 million events/day

> 400MB/sec: can probably handle up to around 200+ million events/day

 

Reference articles for IOPS from VMWare

 

Keeping the LEM Stable as Event Load Increases

Stable environments change over time and resource options increase based on the incoming event load. It is important to take increases in logging into account as you make decisions on where to deploy LEM or migrate the LEM to. 

 

Feel free to contact our technical support for further details or to help with a performance assessment on a currently deployed LEM Appliance.

 

Disclaimer: Please note, any content posted herein is provided as a suggestion or recommendation to you for your internal use. This is not part of the SolarWinds software or documentation that you purchased from SolarWinds, and the information set forth herein may come from third parties. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment.  You elect to use third party content at your own risk, and you will be solely responsible for the incorporation of the same, if any.

 

 

Last modified

Tags

Classifications

Public