Submit a ticketCall us

Training ClassThe Orion® Platform Instructor-led Classes

Provided by SolarWinds® Academy, these trainings will introduce users to the Orion Platform and its features, management, and navigation. These courses are suitable for users looking to discover new tips, tricks, and ways to adapt their Orion products to better suit their monitoring needs:
Deploying the Orion Platform
Configuring Orion views, maps, and accounts
Configuring Orion alerts and reports

Reserve your seat.

Home > Success Center > Log & Event Manager (LEM) > LEM - Knowledgebase Articles > LEM traffic limitations

LEM traffic limitations

Table of contents
Created by Craig O’ Neill, last modified by James Moore on Jan 23, 2019

Views: 1,258 Votes: 2 Revisions: 10

Updated: January 23, 2018


This article discusses the amount of traffic that LEM can process.


All LEM versions


  • LEM traffic depends on the amount of resources available per the amount of tasks LEM is carrying out.
  • As a benchmark, LEM can process 200 Million events per day.
  • LEM resources can be used up if the following activities are performed by the events:
    • Run through filters on the GUI
    • Trigger rules
    • Trigger emails at the same time
  • The following is a guide of the number of resources used for every event:
    • 0->15 million events/day a 8GB of RAM & 2-CPUs (any combination of processors/cores/sockets)
    • 15->35 million events/day a 16GB of RAM & 4-CPUs
    • 35->60 million events/day a 24GB of RAM & 6-CPUs
    • 60->90 million events/day a 32GB of RAM & 8-CPUs
    • 90->130 million events/day a 64GB of RAM & 10-CPUs
    • 130->200 million events/day a128GB of RAM & 12-CPUs
      • Assumptions (Recommended setting reservations):
        • No unmatched data
        • No WFP (© Microsoft 2019, available at, obtained on January 23, 2019) noise
        • Less than 500 rules firing per day
        • No agent connection issues
        • RAW database is disabled
  • Enabling RAW database increases the capacity.
  • RAW DATABASE: = RAW Syslog or trap data - this is not enabled by default
  • If WFP is above 30% of data, rules firing above 5,000 per day, 500+/day duplicateAgent or 500+/day unknownAgent, or 10,000+/day unmatched,  increase the Reserved Memory.




Last modified