Hi,
We have been using KIWI Syslog for a few years now and out Syslog traffic has steadily increased over time. We now average over 700K MPH during the week, reaching +1200K MPH during business hours. Due to some upcoming DHCP implementations I expect that number to increase substantially.
Although the KIWI syslog server doesn't seem to have too much trouble keeping up our SQL server is suffering from some disk I/O bottlenecks. We are going to upgrade our SQL system shortly and I have been mulling over the best way to re-invent our installation. This got me to wondering about a few things. For one, I don't seem to find any discussion over whether hosting the KIWI syslog daemon on the same server as the SQL instance. The system requirements for the KIWI serve seem minimal. Having KIWI retransmit well over 1+ million messages an hour not only increases the load on the KIWI server but the network as well.
I guess my questions are along the lines of the following:
1. Are there any best practices regarding where the SQL instance is installed, local to the KIWI or on a separate platform?
2. Is there a MPH threshold where this would make clear sense?
3. Is KIWI tuned to provide an efficient means of logging to a co-resident SQL instance?
Curious what others are doing and would appreciate any thoughts on the matter.
Thanks,
BobL.