wan usage
|
Logged in as: Guest
|
|
Users viewing this topic:
none
|
|
Login  | |
|
wan usage - 24.Oct.2006 3:48:23 AM
|
|
|
mpietsch
Posts: 12
Score: 0
Joined: 24.Oct.2006
Status: offline
|
since upgrading from selm5 to evtmgr7 i noticed the wan usage rose.
we have 3 servers in another branch (wan connection = 2mbit)
does evtmgr7 download the whole .evt file from a server to process it local or does it copy only the events added since the last scan?
_____________________________
regards
michael
- This posting is provided "AS IS" with no warranties, and confers no rights. -
|
|
|
|
|
RE: wan usage - 24.Oct.2006 4:46:32 AM
|
|
|
Arielle
Posts: 294
Score: 0
Joined: 15.Sep.2006
Status: offline
|
Hi Michael,
WAN traffic might increase when upgrading because EventsManager is a lot faster than SELM.
EventsManager doesn't copy the files locally, but it gets the events since the last scan directly from the remote EVT.
_____________________________
Arielle Bonnici - Quality Metrics Analyst
GFI Software - www.gfi.com
|
|
|
|
|
RE: wan usage - 24.Oct.2006 5:53:54 AM
|
|
|
mpietsch
Posts: 12
Score: 0
Joined: 24.Oct.2006
Status: offline
|
is it possible to throttle a server group?
_____________________________
regards
michael
- This posting is provided "AS IS" with no warranties, and confers no rights. -
|
|
|
|
|
RE: wan usage - 24.Oct.2006 7:00:10 AM
|
|
|
Arielle
Posts: 294
Score: 0
Joined: 15.Sep.2006
Status: offline
|
If I am understanding you correctly, your question is whether GFI EventsManager supports configuring limits on the bandwidth used to retrieve events from a remote location.
If that is what you were after, then no, GFI EventsManager does not support bandwidth throttling.
Having said that I will be forwarding this to the development team as a feature request.
_____________________________
Arielle Bonnici - Quality Metrics Analyst
GFI Software - www.gfi.com
|
|
|
|
|
RE: wan usage - 24.Oct.2006 7:49:14 AM
|
|
|
mpietsch
Posts: 12
Score: 0
Joined: 24.Oct.2006
Status: offline
|
an option to set a bandwith per group would be nice. (for wan servers)
i'll try to work around with QOS or I'l set the scan intervall higher.
< Message edited by mpietsch -- 24.Oct.2006 7:51:31 AM >
_____________________________
regards
michael
- This posting is provided "AS IS" with no warranties, and confers no rights. -
|
|
|
|
|
RE: wan usage - 8.Dec.2006 2:45:43 PM
|
|
|
systadmin
Posts: 11
Score: 0
Joined: 10.Aug.2005
From: Florida
Status: offline
|
You could change the speed of the network card in your server.
|
|
|
|
|
RE: wan usage - 18.Dec.2006 8:25:33 AM
|
|
|
RayPesek
Posts: 246
Score: 0
Joined: 7.May2004
Status: offline
|
So if I understand this correctly, EM, like SELM, only pulls events since the last scan but it does it a lot faster, hence the increase in bandwidth?
That doesn't sound right. Our T-1 WAN utilization rose 5 times and maxxed out the line with EM. If EM was faster, I would see intermittent bursts but it's saturating the line.
We were using 15-minue update intervals with SELM and it kept up OK (50 servers), so the quantity of the data does not seem to be the issue.
Part of it may be that EM actually grabs the Application and System logs whereas SELM had a check box to do so but never did (at least for us).
We've now shut down EM and are back on SELM.
Ray
|
|
|
|
|
RE: wan usage - 20.Dec.2006 10:19:54 AM
|
|
|
RayPesek
Posts: 246
Score: 0
Joined: 7.May2004
Status: offline
|
We have about ten servers and 375 employees on the other side of that T-1. With SELM and all of the business traffic, the T-1 runs at 10% to 15% average and rarely peaks above 50%. The night and weekend employee count drops to about 40 and the normal T-1 usage is 1%.
As soon as we start the EM service, the line saturates at 100% and stays there 24x7. That's not a deployment scenario problem.
Ray
|
|
|
|
|
RE: wan usage - 21.Dec.2006 10:18:39 AM
|
|
|
mpietsch
Posts: 12
Score: 0
Joined: 24.Oct.2006
Status: offline
|
i noticed the same behavoir.
our mrtg drawed a peak nearly 2mbit (for about 10mins) at every scan intervall, then i had a look at the processed events... sum=63.
isnt that a bit much for 63 events?
at the moment we helped us throttling and scanning at midnight but thats not really a solution.
with selm5 there was no problem like this.
_____________________________
regards
michael
- This posting is provided "AS IS" with no warranties, and confers no rights. -
|
|
|
|
|
RE: wan usage - 12.Jan.2007 8:39:57 AM
|
|
|
Calin Ghibu
Posts: 1194
Score: 0
Joined: 15.Dec.2002
Status: offline
|
Guys,
There is a huge improvement in processing power/speed betweenSELM and ESM. The latter is now multithreaded with independent connections per thread, etc. You can not expect it to use same bandwidth as SELM.
SELM was scanning 200 events per second. ESM is scanning 1500-2000 per second. An event can be as large as 1 KByte, with an average of 300 bytes. That means you have an average of 450 KB - 600 KB with peaks of 1.5 MB-2MB all per second, FOR TRANSPORT OF EVENT DATA ONLY. Add to this connection packets for each job, other operations for accesing the event logs and so on, in order to see the amount of bandwidth you need.
I really do not see how can you overlook such arguments.
Another note, you are saying this is not a deployment issue. But what kind of issue do you believe it is?
Why don't you give the deployment guide a chance? There was a lot of work put into it so it will be easier for you to deploy the product.
If you read that guide you would have seen that GFI DOES NOT RECOMMEND scanning over the WAN. It was not recommended for SELM either, however you could work with it because scanning and processing were simpler and obviously less performant.
Now unless you have a WAN bandwidth capable of handling the above, plus your WAN needs, you need to consider placing an instance of ESM at each site (data centralization will be available soon), or scann over the WAN at times when your production load is low.
The growth in bandwidth consumption is normal considering the reasons and arguments.
Best regards,
Calin
< Message edited by Calin Ghibu -- 12.Jan.2007 8:43:43 AM >
|
|
|
|
|
RE: wan usage - 12.Jan.2007 9:08:31 AM
|
|
|
RayPesek
Posts: 246
Score: 0
Joined: 7.May2004
Status: offline
|
Thanks for the detailed response, Calin. That would make a good KB article. Here's one of the issues with WAN deployment :-)
--------------------------------
"The GFI EventsManager WAN Connector is designed specifically for multiple domain/geographical sites. It connects the various database backends to a single data source, allowing you to consolidate all or part of the events data collected on to one central database. Reports can then be run using data from the central database.
Note: the GFI EventsManager WAN Connector will be available by end 2006."
--------------------------------------------
It's not listed in the pricelist, so I presume it's not available yet. As I recall, it was an extra cost item for SELM but I don't know if that's the case with EM.
Nobody recommends scanning across a WAN but we have WAN optimization devices in place at some of these locations and it's still clobbering us. SELM is a real pain as the database grows and we've had numerous performance issues and corruption issues with the SQL 2000 backend. I agree that EM is dramatically improved and that's why we want to use it.
I'm kind of between a rock and a hard place here. I occasionally lose SELM historical data because of database corruption and I need a replacement system. EM looks perfect, but it noticeably degrades our operations.
Do you know when the WAN connector will be available and whether it will be extra cost?
Thanks,
Ray
|
|
|
|
|
RE: wan usage - 12.Jan.2007 9:34:07 AM
|
|
|
Calin Ghibu
Posts: 1194
Score: 0
Joined: 15.Dec.2002
Status: offline
|
Hi Ray,
I understand your concern, and do agree with your arguments which are very valid. Unfortunatelly the WAN Connector of EventsManager is not available at this moment for public, as the text you have posted wrongfuly states.
However I "believe" it will be available as a beta by the end of this month.
I know it is a problem for you at this point, but please be patient for the EventsManager build which will have this functionality.
I am sure it is worth the wait and I believe you will have a plesant surprise when you will be seeing it.
Regarding pricing, I am not really the man to give details on this aspect, however it might be extra priced. However I do not know how and for who etc.
Best to contact sales as soon as it is out.
Thanks and regards,
Calin
|
|
|
|
|
RE: wan usage - 15.Jan.2007 8:24:02 AM
|
|
|
kmacg
Posts: 6
Score: 0
Joined: 5.May2006
Status: offline
|
Hi Calin,
Can I suggest that someone uses Wireshark/Ethereal to capture/analyze the traffic generated while collecting events from a server over a 'slow' link? I did some testing a while back and the collection of only 6 events from a single log (over a 256Kb link) generated over 1 MB of traffic, which does seem disproportionately high.
Like Ray & Michael, I too find that when I try to collect (even low numbers <100) of log entries from a single remote server, then the collection process completely saturates the WAN link.
Thanks,
Kevin
|
|
|
|
|
RE: wan usage - 22.Feb.2007 5:13:35 PM
|
|
|
kmacg
Posts: 6
Score: 0
Joined: 5.May2006
Status: offline
|
Hi again,
Quick update: I'm currently testing the latest Beta version and the performance accross the WAN is greatly improved. I'd be interested in hearing if anyone else has seen a similar improvement?
Thanks,
Kevin
|
|
|
|
 New Messages |
 No New Messages |
 Hot Topic w/ New Messages |
 Hot Topic w/o New Messages |
 Locked w/ New Messages |
 Locked w/o New Messages |
|
 Post New Thread
Reply to Message
Post New Poll
Submit Vote
Delete My Own Post
Delete My Own Thread
Rate Posts |
|
|
Printable Version
