Submit a ticketCall us

Systems Monitoring for Dummies
Our new eBook will teach you the fundamentals and help you create monitors and alerts that are effective, meaningful, and actionable. Monitoring is more than a checkbox on your to-do list. This free eBook will give you practical advice to help you succeed in all aspects of monitoring – discovery, alerting, remediation, and troubleshooting. Don’t miss out on this indispensable resource for newbies, experienced IT pros, and everyone in between. Register Now.

Home > Success Center > Log & Event Manager (LEM) > LEM traffic limitations

LEM traffic limitations

Table of contents
Created by Craig O’ Neill, last modified by MindTouch on Jun 23, 2016

Views: 68 Votes: 2 Revisions: 4

Overview

This article discusses the amount of traffic that LEM can process.

Environment

All LEM versions

Detail

  • LEM traffic depends on the amount of resources available per the amount of tasks LEM is carrying out.
  • As a benchmark, LEM can process 200 Million events per day.
  • LEM resources can be used up if the following activities are performed by the events:
    • Run through filters on the GUI
    • Trigger rules
    • Trigger emails at the same time
  • The following is a guide of the number of resources used for every event:
    • 0->15 million events/day a 8GB of RAM & 2-CPU’s (any combination of processors/cores/sockets)
    • 15->35 million events/day a 16GB of RAM & 4-CPU’s
    • 35->60 million events/day a 24GB of RAM & 6-CPU’s
    • 60->90 million events/day a 32GB of RAM & 8-CPU's
    • 90->130 million events/day a 64GB of RAM & 10-CPU’s
    • 130->200 million events/day a128GB of RAM & 12-CPU’s
      • Assumptions (Recommended setting reservations): 
        • No unmatched data
        • No WFP noise
        • Less than 500 rules firing per day
        • No agent connection issues
        • RAW database is disabled

Notes: 

  • Enabling RAW database increases the capacity.
  • RAW DATABASE: = RAW Syslog or trap data - this is not enabled by default
  • If WFP is above 30% of data, rules firing above 5,000 per day, 500+/day duplicateAgent or 500+/day unknownAgent, or 10,000+/day unmatched,  increase the Reserved Memory.

 

 

Last modified

Tags

Classifications

Public