Merge pull request #123 from splunk/feature/doc-sizing

Fixes #112
CSVD · Oct 7, 2019 · 0c0edf2 · 0c0edf2
2 parents bb658b1 + 27b552f
commit 0c0edf2
Show file tree

Hide file tree

Showing 3 changed files with 20 additions and 3 deletions.
diff --git a/docs/SC4S deployment.png → docs/SC4Sdeployment.png b/docs/SC4S deployment.png → docs/SC4Sdeployment.png
diff --git a/docs/gettingstarted.md b/docs/gettingstarted.md
@@ -21,6 +21,7 @@ instance in the same VLAN as the source device.
 environment.
 * Avoid TCP except where the source is unable to contain the event to a single UDP packet.
 * Avoid TLS except where the event may cross a untrusted network.
+* Plan for appropriately sized hardware (see)[performance.md]
 
 
 # Implementation
@@ -81,4 +82,4 @@ Splunk type.
 
 Additional hosts can be deployed for syslog collection from additional network zones and locations:
 
-![SC4S deployment diagram](SC4S%20deployment.png)
+![SC4S deployment diagram](SC4Sdeployment.png)
diff --git a/docs/performance.md b/docs/performance.md
@@ -22,5 +22,21 @@ average rate = 9717.58 msg/sec, count=1749420, time=180.026, (average) msg size=
 
 ## Limitations
 
-Splunk Enterprise's implementation of the http event collection server responds to the client with a status code 200 and fails to commit the events to disk during a rolling restart. In our testing, 20-30 events per indexer are lost.
-
+In our tests, if Splunk Enterprise’s implementation of the http event collection server responded to the client with a status code 200 and failed to commit the events to disk during a rolling restart, then 20-30 events per indexer were lost.
+
+## Guidance on sizing hardware
+
+The following reference deployment hardware specifications are based on Splunk performance testing results in Amazon Web Services. 
+The overall load on your deployment hardware will vary based on the percentage of events not handled by a filter or use of 
+exceptionally complex regex in filters. While we consider the following conservative, actual hardware performance will vary
+due to network interface card, driver, kernel version, exact CPU, type of memory and configuration. SYSLOG is a fire 
+and forget protocol making it sensitive to performance. Given this it is highly recommended that you validate 
+performance with your hardware and production data samples. The syslog-ng loggen tool available in the SC4S container 
+and the commands above can be utilized in this effort.
+
+Deployment Size | Hardware Spec | Average EPS with average msg size 800 k
+-- | -- | --
+Small | 2 X 3.1 ghz cores1 GB of memory | 2K msg/sec
+Medium | 4 X 3.1 ghz cores2 GB of memory | 4.5K msg/sec
+Large | 8 X 3.1 ghz cores4 GB of memory | 9K msg/sec
+XL | 16 X 3.1 ghz cores8 GB of memory | 18K msg/sec