Performance drop, waste of CPU Credits

Comments

1 comment

  • Avatar
    Brian Goleno

    Mykola, 

    Although I am the Product Manager for data ingest, I am not the expert at determining the optimal settings for your collector configuration.  I assume that although this is a Windows Server, the Source you are configuring is a file source?  Usually, high CPU usage is related to folder traversal, and the amount of regex processing that is occurring.  Another factor is the size of the file that has to be parsed through.  Others can chime in on the optimal settings.

    The "local.win.event.collection.flag = 0" property that you mention is no longer relevant. That applies to Windows Event collection. It told the collector to use the Legacy API. We totally refactored the design of that Source. It is now much more performant, and we removed the support for the old, legacy Windows API. 

    Regarding the CPU Target setting. That is a best effort setting to try and keep the CPU utilized by the Sumo Collector process below that target.  It only applies to the File Source. It will slow the rate of directory scans and decrease parallel file processing, to a minimum level, until the target is reached.  However, if you have large file directories, are configured for lots of recursion, or have very large individual files, these will limit the impact of that setting.  

Please sign in to leave a comment.