I'm not sure about how our receiver architecturing. Is there any buffer before event will be picked up for processing.
I want to know more about its buffer architecture to answer following questions:
Thank you in advacned.
Message was edited by: parinya.ekparinya on 11/22/12 4:53:04 AM CST
I'm not sure if you are looking for technical specs of a particular receiver model or just looking for general "How Does it Work?" type information.
For the majority of the Receiver data sources (i.e. syslog,Microsoft wmi, McAfee ePO etc..), the event data is first written or "cached" to a file on disk. The data is then parsed and inserted into the Receiver Database. Next the data is transferred from the Receiver Database to the ESM Database and finally displayed in the User Interface.
Really, the only limiting factors to the amount of data a Receiver can "cache" during traffic bursts or otherwise are the NIC capabilities, the Receiver Disk Capacity and the Database Record Capacity.
*The NIC is limited to 1GB network traffic speeds.
*The disk capacity is limited to its data RAID size(typically between 500GB and 1TB).
*The Database is limited to 250 million records.
The EPS ratings are an approximate limitation to the rate at which data can be inserted into database.
So to answer your questions specifically...
* How much percentage of EPS burst can receiver handle and also how long can it take?
- A "burst" can last as long as it does not cause the device to exceed the above mentioned limitations.
* If the connection between ESM and Receiver is loss, will events cached on event receiver?
- If the connection between the ESM and Receiver is lost, the Receiver Database will "cache" the event data until 250 Million records have been reached from the last successful data transfer.
* If receiver caches events, what's used for caching, Memory or disk?
- The receiver will first cache the incoming event data in file format on disk and then once it is written to the database the files are removed. The events are then stored in the receiver database until the record count has reached the 250 million count at which point the oldest data is overwritten with the newest.
*How long can receiver cache events? Any example case?
- The receiver can cache events as long as the maximum record count is not exceeded. I have seen receivers with 2 to 3 years of data on them and others that roll the data on a monthly basis. It just depends on how much data is coming in and how fast the 250 million record count is reached.
Let me know if this is what you were looking for.
Actually, what I'm looking for is "How Does it Work?".
What you told me is exactly what I want to know.
Thank you very much for useful information.
If you don't mide, I have a few more questions:
Thank you in advacned.
Below are the answers to your questions.
Let me know if you have any additions questions.