9 Replies Latest reply on Nov 29, 2012 10:56 AM by nicole pauls

    LEM virtual appliance performance

    kris_mortensen

      All-

      I currently have about 50 Cisco ASA devices and 25 domain controllers sending logs to our virtual lem appliance.  We have at least 300 more servers that need to be added as managed nodes into the appliance. Currently we have the appliance configured with 8 GB of RAM, and 2 CPU sockets with 2 cores each. The appliance is consistently consuming 90 or more percent of the CPU resources and 80% of the memory resources at the moment. We have a vm host that we are provisioning just for this appliance with 2 quad core processors and 64 GB of RAM... but I'm not sure that will be enough at the rate that this is consuming resources. The web interface is unresponsive due to resource consumption.  What can I do?

       

      Also, I see that the virtual appliance has 2 network adapters on it.... we are only using one. How should the second one be configured?

        • Re: LEM virtual appliance performance
          nicole pauls

          Hey Kris,

           

          One of the things we've found is that it's helpful to set reservations for min/max settings, even if you're not on the high end. Letting VMware decide means that it's constantly adjusting and that constant adjustment seems to come at a price.

           

          The second network adapter is used in some configurations, but generally not necessary.

          • Re: LEM virtual appliance performance
            byrona

            kris_mortensen, I would love for you to post back here and let me know what kind of performance you are able to get out of your LEM system with that many systems logging to it.

              • Re: LEM virtual appliance performance
                kris_mortensen

                I can tell you that right now, I have done the following:

                 

                -          moved the virtual appliance to its own ESXi host

                 

                -          reduced the cpu resources from 2 sockets with 2 cores to 2 sockets with 1 core

                 

                -          left the memory resources at 8 GB

                With that configuration, and about 70 nodes being managed, I am seeing the following:

                cid:image001.png@01CDCE0B.E1860030[cid:image002.png@01CDCE0C.453CBBF0]

                cid:image003.png@01CDCE0C.453CBBF0

                 

                Initially, I had adjusted the VM so that it didn’t have unlimited resources as Nicole suggested. Unfortunately, this quickly resulted in CPU Ready alarms, and with our optimizer recommending giving it more resources. In the end, I was able to change this back to Unlimited resources and reduce the number of cores, and actually saw better performance. Keep in mind though that the better performance I saw only occurred after I moved the VM off to its own host as well.  I can keep everybody posted on performance that I see as I add more nodes in…

                  • Re: LEM virtual appliance performance
                    nicole pauls

                    I believe the 5.5 release will help with the zig zaggy stuff you're seeing. It's not actually in a hotfix, but support can also do a manual adjustment if you don't want to wait.

                     

                    We do have some general guidelines on resources, scaling, and tuning that our support team uses with customers, but because of the variation in environments, bottlenecks, and configurations, we haven't been able to release anything to customers...yet.

                     

                    PS: You might want to check reservations on memory as well, similar experience applies.