13 Apr
2015
13 Apr
'15
4:37 p.m.
Just to give a performance example for the patterndb parser. We process approximately 5,000 msg/sec and use two patterndb parsers. One with 20,000 patterns and another with 4.300 patterns. All messages go through both parsers. This consumes about 5% of a 2 socket, Intel X5675 (6 core), 3GHz cpu system. Evan. On 04/12/2015 11:51 PM, Fabien Wernli wrote:
Hi Mikkel,
On Mon, Apr 13, 2015 at 06:48:06AM +0000, Mikkel Leth Carlsen wrote:
And yes, the parser is extremely fast. My current setup is currently processing (and parsing) around 20k events per second on a 2 CPU VMWare instance without any signs of problems… How many rules do you have, if I may ask?