Hi,

Just needed some analysis / documents / casestudy if someone has one for syslog setup. I need to make sure if the hardware / VM required for it, how many processors / RAM / Disk would be required (say retention period of 1 year).

Is there any documents or links which can help my calculations ? I guess there is no thumbrule for it, but if incase anyone has done any sort of analysis will be helpful.

Cheers.

There aren't any, since the answer to ANY of these questions is going to be "it depends".

• How many processors/RAM?

  Depends on how many clients are connected, sending how much data, how often they're sending it, and how many filters you have set up in syslog-ng.

• How much disk?

  See previous answer

Ten devices that are pounding it 24/7 will need a good sized system to collate the data into the different files, retain them for as long as you want, and the CPU/RAM needs will go up, along with how much bandwidth it will use 1000 devices that send a few messages every now and then will be trivial.

Have a well thought out plan first. Decide how you're going to organize the different data streams into what kinds of file/directory names, get some sort of process running to prune those files and compress them on a regular basis (you may want to retain them for a year, but do you need an ENTIRE YEARS worth of log data uncompressed at all times? Or will one small tar.gz file per month be what you want?).

1 members found this post helpful.

Am I sniffing a student project here? It takes one to know one :-)

I have 113MB in /var and 63MB in /var/log and this install is 6-7 months old. But this is a home box, with low logging and basically no server usage.

When you are running a server, the big ones are inclined to be /home (esp with apache running), /var, & /tmp. The system or / is small by comparison - 20 gig is usually plenty. If you really have no clue what you want, one way out is to employ LVM, which allows resizing without too many issues.

If you have to guess, and nobody else replies, go for
/home/, /var/ & /tmp/ - 30% each with / as 20Gig min.

Standard server sizes are a few hundred gig each for those. But your workload dictates. I'm on a 60G ssd, with 2 versions of linux, and definitely small scale.

1 members found this post helpful.

@TB0ne : Thanks for the points you have mentioned here. I have done some work already on what all you mentioned.

@Business_kid : Your reply really satisfies a student project only ;-) Its not only the disk in question, I was more concerned about the CPU and RAM calculations etc.

Cheers.

rotfl.