SmartEvent, SmartEvent correlation unit and Log Server machine

[Constant]

Hi Team,

I will déploy my first SmartEvent server and I need your advices.

Here is the environment:
- A cluster of gateway
- A dedicated virtual machine with SmartCenter
- A dedicated virtual machine with SmartEvent Server and SmartEvent correlation unit

My question:
- is it recommended to enable Log server on SmartCenter or on virtual machine that runs SmartEvent Server and SmartEvent correlation unit ?

Based on sk80720 (SmartEvent Performance Tuning Guide), it's recommended to run SmartEvent Server and SmartEvent correlation unit on Log Server machine
"SmartEvent correlation unit runs best when installed on your Log Server machine. In case they are distributed, make sure the SmartEvent correlation unit runs on the Log Server machine (rather than on the SmartEvent server machine)"

Based on the official document "CP_R80.40_Installation_and_Upgrade_Guide", page 32, it's recommended to run SmartEvent Server that is not a Log Server

In advance, thank for your help.

Thanks

[Amir_Senn]

That depends on your amount of traffic on your env and amount of time you want to retain the log information.

IMO, it's best not to activate the SmartEvent on SmartCenter if you have a dedicated machine for SmartEvent server.

SmartEvent may index slower than other log servers because it indexes more fields and hold more information, so I might suggest adding a dedicated VM for log server if you feel it's too slow or if you want to retain more logs/indexes over time.

[Constant]

Hi Amir,

Thank for your reply.

My intention was not to activate SmartEvent on SmartCenter.

As you written that "SmartEvent may index slower than other log server", I plan to activate Log Server on SmartCenter and not on SmartEvent server.

Regards

[Amir_Senn · Accepted solution]

Sorry for the confusion, I meant using the SmartCenter as a log server.

Myself I think that it's better to use SmartEvent as log server rather than the SmartCenter. I like to distribute load and risks among different servers.

Having said that, there is nothing wrong about using SmartCenter as a log server.