Quantcast
Channel: THWACK: Message List - Security Event Manager (SEM) - Formerly Log & Event Manager
Viewing all articles
Browse latest Browse all 5385

Re: How to tell if you are setup to use raw logs in LEM

$
0
0

Raw logging does have a large impact on required resources so that could definitely be part of it.  If you don't need it, I would suggest turning it off.

 

You will also want to review articles such as this one for performance checks:

 

LEM performance checks - SolarWinds Worldwide, LLC. Help and Support

 

I would start with running the Database Maintenance Report and comparing your events per day to this chart from the KB:

 

  •     0->15   million events/day => set 8GB of RAM & 2-CPU’s (this is default, any of processors/cores/sockets)
  •   15->35   million events/day => set 16GB of RAM & 4-CPU’s
  •   35->60   million events/day => set 24GB of RAM & 6-CPU’s
  •   60->90   million events/day => set 32GB of RAM & 8-CPU's
  • 90->130  million events/day => set 64GB of RAM & 10-CPU’s
  • 130->200 million events/day => set 128GB of RAM & 12-CPU’s

 

Those are two of the first things that I would check, but if there are any Internal errors or messages you're seeing or recent rule configurations that you made, they could play a factor as well.  Support can help identify a lot of this very quickly, but that KB article has a lot of the information that you would want to review as well.


Viewing all articles
Browse latest Browse all 5385

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>