2.7 Recommended Limits

The limits mentioned in this section are recommendations based on the performance testing done at Novell or at customer sites. They are not hard-limits. The recommendations are approximations. In highly dynamic systems, it is a good practice to build in buffers and allow room for growth.

2.7.1 Collector Manager Limits

Unless otherwise specified, Collector Manager limits assume 4 CPU cores at 2.2 GHz each, 4 GB of RAM, running on SLES 11.

Table 2-2 Collector Manager Performance Numbers

Attribute

Limits

Comments

Maximum number of Collector Managers

20

This limit assumes each Collector Manager is running at low EPS (e.g, less than 100 EPS). The limit decreases as the events per second increase.

Maximum number of Connectors (fully utilized) on a single Collector Manager

1 per CPU core, with at least 1 CPU core reserved for the operating system and other processing

A fully utilized Connector is one that is running at the highest EPS possible for that type of Connector.

Maximum number of Collectors (fully utilized) on a single Collector Manager

1 per CPU core, with at least 1 CPU core reserved for the operating system and other processing

A fully utilized Collector is one that is running at the highest EPS possible for that type of Collector.

Maximum number of event sources on a single Collector Manager

2000

The limit of the Sentinel Log Manager server is either 1000 or 2000, depending on the hardware. If the server limit is reached on a single Collector Manager, then the limit of event sources for the overall Sentinel system has been reached with that single Collector Manager.

Maximum number of event sources per Sentinel Log Manager server instance

2000

2.7.2 Reports Limits

Table 2-3 Reports Performance Numbers

Attribute

Limits

Comments

Maximum number of saved reports

200

 

Maximum number of reports running simultaneously

3

The limit assumes that the server is not already highly utilized performing data collection or other tasks.

2.7.3 Actions EPS Limits

Unless otherwise specified, the Actions EPS limits assume that one action is configured per rule.

Table 2-4 Actions Performance Numbers

Action

EPS per Action

Sentinel Link

300

Log to File

30 - 50

Send an email

40

Log to Syslog

5 - 10

Execute Script

5 - 10

2.7.4 SLES Open Files Limits

In systems with a large number of event sources (for example, more than 75), with the majority using the File Connector and the offset set to the beginning of the file, the SLES open files limit might not be the same as the number of files currently open in the system.This might lead to performance issues on Sentinel Log Manager.

To avoid this issue, you can set the soft and hard limits for the maximum number of open files based on the number of files that are open.

Perform the following steps to set the open file limits:

  1. Log in to the system as novell user.

  2. View the number of files that are open for the sentinel (novell) user.

    lsof | wc -l

  3. View the hard and soft limits:

    ulimit -Hn

    ulimit -Sn

    Based on the number of open files, the file descriptor limits in the /etc/security/limits.conf file can be set. For example, if the number of open files is 1000, the limits can be set to 2000.

    NOTE:Only the root user can edit the /etc/security/limits.conf file.

  4. Ensure that root user sets the file descriptor limits as follows:

    novell soft nofile 2000

    novell hard nofile 2000

    NOTE:Setting the soft limits is optional, however, setting the hard limits is mandatory.

  5. Save the changes.