Self-Solve Knowledge Search

Minimize Maximize
Increase logger throughput
This document has been retired from the knowledgebase
Title :
Increase logger throughput
Document ID :
KM02174570
Product - Version:
arcsight connector appliance ; arcsight express appliance ; arcsight identity view ; arcsight esm appliance ; arcsight application security monitor ; arcsight express ; arcsight esm compliance insight pkgs ; arcsight express virtual appliance ; arcsight express all in one ; arcsight application view ; arcsight enterprise view ; arcsight dns malware analytics ; arcsight express aio appliance ; arcsight enterprise security manager ;
OS :
Updated :
Mon Mar 07 15:40:29 GMT 2016
Summary :
< !--Obsolete--> Michaela: author never responded back with updates on this new article hence retiring as not all necessary information was included Use when event batch size is too big

To increase logger throughput when event batch size is too big:

i. Navigate to /opt/arcsight/logger/current/arcsight/logger/bin/scripts

ii. Make a backup of servers.sh file ( cp servers.sh servers.sh.default)

iii. Edit servers.sh
- Find the line beginning “ARCSIGHT_JVM_OPTIONS”, and edit the –Xmx4096m and replace it with –Xmx8144

iv. Navigate to /opt/arcsight/logger/ userdata/logger/user/logger/

v. Edit logger.properties
- Add rawevent.reader.capacity=8 (if the value is already there, edit it to equal 8)

vi. Stop Logger Service (logger_server) and after successfully stop, start again Logger Service.