Is the scalability / performance of community vs enterprise edition any different? We tried the community edition for WEC/WEF and it appears to be dropping logs at 2000 eps. We're wondering if there are any configuration we should be aware of. Moreover, please provide sizing recommendations: > What eps can a single nxlog agent support for WEC/WEF collection? > How many VM's of what size (CPU cores and GB memory) should we plan for to support 50,000 eps?

OK, first cry for help. I've an install that I have inherited from a colleague - until four days ago I had never seen nxlog - and it has caused some performance issues. The issue is that the are problems are occurring on VDIs on a cloud infrastructure. The cloud provider (a local operation, not one of the big boys like Amazon and Azure) says that they keep seeing machines suddenly taking large amounts of memory for periods of up to 5 minutes. This stops new processes being created (so you can't start task manager to ientify which process is hogging the memory, and in some cases it locks the VDI up so that the user has to be moved off it. The cloud providers are saying that this was not aproblem before nxlog was installed at the start of the week. (However, the reason my colleague installed it is that the infrastructure has been attacked and there's at least some indicaion of compromise: so we are logging it to track any possible misuse)  Am I right in thinking that adding a sleep statement to the conf file (which the documentation describes as a kind of poor man's rate limiting), passing the conf file out to all the instances on the individual VDIs, and then restarting services, should alleviate this? Or need I look elsewhere for the problem? Like I said, please make allowances for n00b status.. J

Are there any numbers about how nxLog performs when it is processing a high rate of messages being placed into a log file? Right now we have a couple of incidents which resulted in a few thousand messages being logged per second. I assume this is more than nxLog can handle but am wondering about any performance testing that has been run