1
answer

Are there any numbers about how nxLog performs when it is processing a high rate of messages being placed into a log file?

Right now we have a couple of incidents which resulted in a few thousand messages being logged per second.

I assume this is more than nxLog can handle but am wondering about any performance testing that has been run

AskedJuly 30, 2015 - 3:32pm

Answer (1)

im_file input should be quite performant but please note that the number of events it can process depends on a lot of factors:

  1. Type of input module usued
  2. Hardware/VM spec
  3. Processing rules (message rewrite, regexp usage, filtering, etc)
  4. Output side

Event if there is a burst of events it should be able to catch up and process those without loosing data after things come back to normal .

AnsweredJuly 30, 2015 - 5:30pm

Comments (1)

  • JasonHuxLey's picture

    We are logging windows file audit through nxlog forwarding it to another server (4core, 20Gb RAM) this central box is handling a mean eps of around 17,000 and we've seen burst rates in excess of 50,000 eps.

    October 10, 2018 - 5:02pm