Performance of community vs enterprise edition for WEC/WEF

Post a different question
3
responses

Is the scalability / performance of community vs enterprise edition any different?
We tried the community edition for WEC/WEF and it appears to be dropping logs at 2000 eps.
We're wondering if there are any configuration we should be aware of.
Moreover, please provide sizing recommendations:
> What eps can a single nxlog agent support for WEC/WEF collection?
> How many VM's of what size (CPU cores and GB memory) should we plan for to support 50,000 eps?

AskedApril 9, 2019 - 7:43pm

Answer (1)

I suspect log dropping is a result of UDP rather than being related to the Windows Eventlog.

The NXLog Enterprise Edition supports WEC/WEF through the im_wseventing module. Performance is heavily dependent on the environment and to process 50k you'll probably need more than one instance. This would be also recommended for HA. A single instance shouldn't require more than 500Mb.
I suggest testing it out yourself.

AnsweredApril 10, 2019 - 11:57pm

Comments (2)

  • mshakir's picture

    Thanks for your response.
    So, the community edition does not support WEC/WEF?
    Also please let me know if there is any difference in performance of Community vs Enterprise version.

    April 11, 2019 - 12:36am
  • Zhengshi's picture
    (NXLog)

    CE does not support im_mseventing at this time as this is an EE only feature. As B0ti suggested, we do have trial version of EE available to make sure it will do what you need.
    https://nxlog.co/products/nxlog-enterprise-edition/download

    April 12, 2019 - 3:52pm