Performance information on using Multiple Archives

Article:TECH137518  |  Created: 2010-08-09  |  Updated: 2010-08-23  |  Article URL
Article Type
Technical Solution


You must know why it is better to setup multiple Storage Rules rather than just using one.


Symantec Security Information Manager (SSIM) 4.6 or Later.


Using multiple archives by creating multiple Storage Rules, is a method of getting the most performance out of the SSIM.

Each archive has an input memory queue separate from the other archives.

Each Storage Rule also uses a separate thread to process events.

This allows quicker processing of events for archiving purposes.

For further performance improvement the different archives can be stored on multiple disks which allows multiple disk writes to occur at the same time.  This is a primary benefit of Multi-path functionality with a SAN.  To use Muti-path, you must have SSIM 4.7.1.

Using multiple archives can also speed up your queries as you only have to query a sub-set of events.

Note that there is a maximum of 16 storage rules that can be set.

Article URL

Terms of use for this information are found in Legal Notices