Connector Appliance to Logger EPS lower then expect

[Glasscock]

We have a new connector appliance (C3400) with a syslog connector receiving ~3000 eps.  It is forwarding logs to a Logger (L7200) at a max of ~350 eps.

We feel it should be able to send much more the ~350 eps to a Logger.

We have the memory increased to 1GB on the Container.

We have tried multi-threading.

We have tried aggregation.

We have tried eliminating extra syslog types.

We are only receiving Cisco ASA and Netscreen FW events via syslog.

Any Suggestions?

[ld3161]

Wouldn't this number be lower anyways since the connector has done its aggregation by time it forwards to logger? Also, check the batching? I have seen improvements by upping it to 300 and 1 sec. Also check the ping between the appliance and logger for network latency. Oh, and whats up John? long time since we spoke. 

[Glasscock]

Hey Lennie, How are you doing man?  Yea, with aggregation the number would be lower, however we can see the connector cache grows and starts to drop events.  We are trying to work with our network guys to test the network connections.

[Vini]

What do you see in the agentdata directory?

If you see lots of .syslogd files then the problem is with the connector not being able to parse logs fast enough.

If that is the case try two things:

• Try disabling aggregation
• Check the connector logs to see if there are error parsing events as these would slow it down

[dan13lp3na]

Not sure if you resolved yet or not but I had the same issue on some syslog connectors (on conapps) with very high input EPS. I am working on a complete post of the experience but Iadded this to agent.properties and have had great success in getting events to the logger much faster.

transport.loggersecure.threads=10

I will be tesing adding transport.loggersecure.multithreaded=true to agent.properites over the next week to see if that improves it more. Will let you know

[kinneysr]

Yea -

I put in the agent.properties for my smartagent ...

transport.loggersecure.multithreaded=true

transport.loggersecure.threads= (not to exceed the number of processors)

... and now I have events flying to the logger.  I have a 7400 model with full text indexing turned on and it is doing really well.

scotty