Ensure that the system resources in the virtual environment have ample virtual space and memory to support the Log & Event Manager software and incoming data traffic. For typical deployments, Log & Event Manager requires 250GB of system resources on the hypervisor. Large deployments may require 2TB of resources, which you can reserve on the VMware ESX(i) 4/5+ and Microsoft Hyper-V 2008 R-2/2012 hypervisors.
By default, LEM deploys with 8GB of RAM and 2 CPUs on the VMware ESX(i) and Microsoft Hyper-V platforms.
Log & Event Manager collects data from a continuous stream of traffic that fluctuates based on user, server, and network activity. The type and volume of traffic varies based on the device sending the traffic and the audit and log settings on those devices.
Log & Event Manager receives data from syslogs and traps using up to 500 connectors that receive data traffic from several supported network devices. These connectors translate (or normalize) the data into a readable and understandable format you can view in the LEM Console.
The connectors display in the Monitor view, pass through the rules engine for specified actions, and move into a database for retrieval by the LEM Reports or nDepth search function. To process the data in real-time, Log & Event Manager requires system resource reservations from the virtual appliance host.
When the volume of traffic exceeds 15 million events per day, be sure to reserve additional system resources to support the additional data traffic.
You can view your virtual appliance resources, reservations, and storage in the Manage > Appliances view. The Appliances grid displays the virtual appliances and their corresponding details.
The Details pane displays information about your selected manager or appliance. This information includes the platform, CPU reservation, and memory allocation. To view the Details pane, click Manage and select Appliances. In the Appliances grid, select the manager or appliance you want to view. If the Details and Properties panes do not appear in the LEM Console, click the Appliances tab at the bottom of the screen.
|Platform||The manager platform name, which can be Trigeo SIM, VMware vSphere, or Microsoft HyperV.|
|CPU Reservation||The reserved CPU memory. Reserving CPU memory ensures enough system resources are available for the allocated CPUs.|
|Number of CPUs||The number of processors allocated to the virtual appliance.|
|Memory Allocation||The maximum amount of memory the manager can use. Set this value at or above the reservation value. You can define this value in the VM configuration. Setting memory allocation to a greater value than the memory reservation has little effect on LEM performance.|
|Memory Reservation||The amount of memory reserved for this system.|
The current connection status of the selected manager or appliance.
The manager or appliance name.
The appliance type (Manager, Database Server, nDepth Server, Logging Server, or Network Sensor).
The manager or appliance software version.
The manager or appliance IP address.
The port number used by the LEM Console to communicate with the manager or appliance.
You can view your reservation settings using vSphere or an SSH client (such as PuTTY). See your VMware vSphere documentation for details about configuring resources, reservations, and storage on a vSphere virtual appliance.
You can view your reservation settings using VMware vSphere. See your VMware vSphere documentation for details about configuring resources, reservations, and storage on a vSphere virtual appliance.
The Provisioned Storage value in the Resource area is the total disk space that Log & Event Manager can use.
At the bottom left, the CPU reservation displays
8MBand the limit to
The Configured value must be at least the same value or higher than the reservation. You may see memory reservations as high as 256GB of RAM for customers over 150 million events per day.
You can also view your reservation settings using an SSH client (such as PuTTY). The SSH client requires the hostname of your LEM appliance.
After you log in, a session window displays.
viewsysinfoand press Enter.
cmc>prompt, type exit to exit the CMC.
Use the following tables to verify your Hyper-V client settings. For details about setting resources, reservations, and storage on a Hyper-V virtual appliance, see your Microsoft Hyper-V documentation.
|Static RAM||8GB, 16GB, 24GB, 32GB, 64GB, 128GB, 256GB|
|Number of processors||2, 4, 6, 8, 10, 12, 14, 16|
|VM reserve CPU cycles||100%|
|Limit CPU Cycles||100%|
|Relative weight for CPU||100%|
|CPU memory details||Click the Advanced tab and set the view and details|
|Reserve CPU cycle||100%|
|Limit CPU cycles||100%|