The performance of Sentinel Log Manager can vary depending on your environment, configuration, and hardware. Novell has done in depth performance testing on the Sentinel Log Manager system to validate and verify the quality attributes of the system, such as scalability, reliability, and resource usage.
Several tests were carried out with the following configuration to determine the duration taken for a search to return initial data:
Hardware: 4 CPU cores at 2.93GHz each, 4 GB of RAM, running on SLES 11
EPS rate: Incoming EPS rate while performing the search is at 2000
Data Storage: All the event data in time range is in the local storage
The following are the observations:
Table 2-5 Search Performance Results
|
Total events |
Number of events matching the Search query |
Time for Initial Search Results |
|---|---|---|
|
10,000,000 |
1,000 - 10,000,000 |
5 - 10 seconds |
|
100,000,000 |
20,000,000 - 100,000,000 |
10 – 30 seconds |
|
200,000,000 |
110,000,000 - 200,000,000 |
1 – 5 minutes |
Several tests were carried out with the following configuration to determine the duration taken for report generation.
Hardware: 4 CPU cores at 2.93GHz each, 4 GB of RAM, running on SLES 11
EPS rate: Incoming EPS rate while performing the search is at 2000
Location of the data: All the event data in time range is in the local storage
The following are the observations:
Table 2-6 Reports Performance Results
|
Total events |
Number of events matching the Search query |
Time for Report Generation |
|---|---|---|
|
10,000,000 |
1,000 - 10,000,000 |
1 - 2 minutes |
|
100,000,000 |
20,000,000 - 100,000,000 |
10 – 50 minutes |
|
200,000,000 |
110,000,000 - 200,000,000 |
1 – 3 hours |
NOTE:For reports with large number of events and large number of fields, such as the Event Details report, the report generation might take a long time and the system might run out of memory. To improve the reports performance results, you can increase the RAM in your system.