Submit a ticketCall us

Looking to compare latest NPM features with previous versions of NPM?
The NPM new feature summary offers a comparison of new features and improvements offered with this release.

 

 

 

 

Home > Success Center > Log & Event Manager (LEM) > LEM traffic limitations

LEM traffic limitations

Table of contents
Created by Craig O’ Neill, last modified by MindTouch on Jun 23, 2016

Views: 885 Votes: 2 Revisions: 4

Overview

This article discusses the amount of traffic that LEM can process.

Environment

All LEM versions

Detail

  • LEM traffic depends on the amount of resources available per the amount of tasks LEM is carrying out.
  • As a benchmark, LEM can process 200 Million events per day.
  • LEM resources can be used up if the following activities are performed by the events:
    • Run through filters on the GUI
    • Trigger rules
    • Trigger emails at the same time
  • The following is a guide of the number of resources used for every event:
    • 0->15 million events/day a 8GB of RAM & 2-CPU’s (any combination of processors/cores/sockets)
    • 15->35 million events/day a 16GB of RAM & 4-CPU’s
    • 35->60 million events/day a 24GB of RAM & 6-CPU’s
    • 60->90 million events/day a 32GB of RAM & 8-CPU's
    • 90->130 million events/day a 64GB of RAM & 10-CPU’s
    • 130->200 million events/day a128GB of RAM & 12-CPU’s
      • Assumptions (Recommended setting reservations): 
        • No unmatched data
        • No WFP noise
        • Less than 500 rules firing per day
        • No agent connection issues
        • RAW database is disabled

Notes: 

  • Enabling RAW database increases the capacity.
  • RAW DATABASE: = RAW Syslog or trap data - this is not enabled by default
  • If WFP is above 30% of data, rules firing above 5,000 per day, 500+/day duplicateAgent or 500+/day unknownAgent, or 10,000+/day unmatched,  increase the Reserved Memory.

 

 

Last modified
20:14, 22 Jun 2016

Tags

Classifications

Public