MonitorWare Knowledge Base

[hylbert]

Since you can set the interval for which the EventReporter will access the Event Log and send messages, are there conditions that will cause the EventReporter to not send all messages because messages are being generated faster than it can send them?

Or, maybe a better question...how many messages will the EventReporter send each interval? Will it send everything that it is new, no matter if it goes into the next interval? Or, will it send a certain amount, maybe some buffer size, and then stop until the next interval?

I would like to put this on a DC that really puts out some events. I would like some advice on how to tune the interval to keep up with messages, but use as little CPU as possible. I'm not worried so much about timing because if the EventReporter is going to keep up with the messages it is going to send them quickly enough.

Thanks,

Drew

[rgerhards]

The interval was introduced not to save CPU time on the reporting machine, but to give slow receivers a chance. So if you don't have an issue with the receiver, set it to 0 (just keep in mind many syslog receivers can not handle this).

If you need to slow down things AND you have a continous stream of fastly generated events - well, then you will not be able to forward all of them. This is correct and by design. Again, keep in mind that the slowdown is done to prevent receiver overrun. As such, we can not send faster. So if your receiver can only handle - let's say - 100 events per seconds BUT you have constanly more than 100 events, then it is time to upgrade the receiver. Because it won't be able to receive that amount. However, if you just have bursts with more than 100 events per second, than everything is fine, because over time all of them will arrive at their destination - just a little bit delayed. If the delay is to long ... again, you should upgrade the receiver.

I hope this clarifies.

Rainer