Quantcast
Channel: THWACK: Message List - Security Event Manager (SEM) - Formerly Log & Event Manager
Viewing all articles
Browse latest Browse all 5385

LEM and Maximizing Disk IO and VMWare Optimization

$
0
0

LEM operability, responsiveness, and report generation has always seemed to be an issue. As we understand hardware functionality, Disk IO, CPU, and Memory are important factors for successful operation of LEM. It has been incredibly challenging to obtain anything from Solarwinds/LEM regarding best practice and recommended settings for both hardware, VMWare and the interfaces within the hardware platforms.

 

We have approximately 130 Million events each day, across about 550 agents, triggering about 1100 rules each day.

 

Have made 3 hardware platform transitions due to LEM slow responsiveness and functionality in the past two years.

1: Dell R710 Series - VMWare shared host platform (96GB Ram), Dual 4-Core CPU's, Equalogic PS6100 SAN Storage System  with 48 SATA drives (Disk IO was slow - less than 100) - 80 Million Events with 350 agents

2: Dell R520 Series - Moved to dedicated VMWare host platform with internal (no SAN) RAID 6 1TB SATA 6Gbs hard drives and 96GB Ram (Disk IO was slow - Less than 200) - 100 Million Events with 430 agents.

3: Dell R530 Series (double bus speed of previous series) - New Dedicated server - VMware host platform with RAID 6 10K SAS 12Gbs drives, Dual 6 Core processors, 256GB RAM. Is worth noting, the 10K hard drives are 12Gbs vs. the older 6Gbs 15K recommended drives. The PERC controllers are 2GB Cache with Dell H730P (The Disk IO we are told by SolarWinds is slow, averaging around 320, we have seen some outliers of 185 to 460) - 130 Million Events with 550 Agents.

 

After multiple migrations, still experiencing slow response, we have asked Solarwinds to make some VMWare tuning and LEM configuration best practice recommendations. We have found nothing of any substantive help providing such guidance, and Solarwinds support will avoid making any direct recommendations.

 

Block-size settings

Memory Allocations to both the host OS and virtual server

Disk and NIC interface drivers and settings

 

Basically, anything that may help improve performance of the virtual world the LEM system operates on and specifically disk IO. At this juncture, we can't just keep throwing $$ and hardware against the wall to see what may work better. there has to be some application tuning available.

 

Ideas/recommendations...

 

How about one of the LEM developers share their best practice recommendations on the VMware settings they obviously developed on... they must have them?

The scalability of the product and hardware needs as the agents/events/rules are added/increase needs a reference point and Solarwinds sells this as a virtual appliance which is very much dependent on the environment its installed on. Such recommendations from Solarwinds on the operating environment would be expected.

 

Why such a secret Solarwinds?


Viewing all articles
Browse latest Browse all 5385

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>