EPS can run into tens of thousands of events per second on large networks. As a result, some SIEM solutions base their pricing on the EPS ingestion rate.

It is nice to say that you have a gigabit network. Still, if you want to copy a file from one server to another, a few other factors come into play, covering all layers of the OSI model. You must consider if your network interface card, OS, CPU, and storage on both ends support the speed to read and write the data. In addition, it highly depends on the data you are transferring; whether it’s 40 GB worth of family pictures or a single virtual disk file makes a big difference.

Dealing with EPS is similar. The speed depends on what kind of logs you are transferring, the transport protocol, and the processing you have configured NXLog to do. For example, are the logs compressed or encrypted along the way? Are you sending them over TCP, UDP, or HTTP(S)? Are logs transferred in batches or one record at a time? In addition, benchmarking EPS throughput must be performed in a similar environment to your production. Even then, it is challenging to forecast what will happen in real life.

Given the many variables that affect log transfer and processing speed, the upside of NXLog is that it gives you the flexibility to optimize the configuration to achieve the best performance possible for your use case.