Performance information on using Multiple Archives

Article:TECH137518  |  Created: 2010-08-09  |  Updated: 2010-08-23  |  Article URL http://www.symantec.com/docs/TECH137518
Article Type
Technical Solution


Issue



You must know why it is better to setup multiple Storage Rules rather than just using one.


Environment



Symantec Security Information Manager (SSIM) 4.6 or Later.


Solution



Using multiple archives by creating multiple Storage Rules, is a method of getting the most performance out of the SSIM.

Each archive has an input memory queue separate from the other archives.

Each Storage Rule also uses a separate thread to process events.

This allows quicker processing of events for archiving purposes.

For further performance improvement the different archives can be stored on multiple disks which allows multiple disk writes to occur at the same time.  This is a primary benefit of Multi-path functionality with a SAN.  To use Muti-path, you must have SSIM 4.7.1.

Using multiple archives can also speed up your queries as you only have to query a sub-set of events.

Note that there is a maximum of 16 storage rules that can be set.




Article URL http://www.symantec.com/docs/TECH137518


Terms of use for this information are found in Legal Notices