Complex deployment example with multiple LEM VMs

To increase performance, you can divide LEM's workload across multiple LEM VMs. Each VM can be configured to provide dedicated processing for tasks such as:

  • Management and event analysis
  • Database storage, search, and reporting
  • Log storage, search, and analysis
  • Log collection

Although multi-VM LEM installations are possible, LEM deployments typically perform well as a single appliance that you can scale up by dedicating additional resources from the virtual host.

Each LEM VM can specialize and provide dedicated processing for one or more of the following:

  • Management and event analysis
  • Database storage, search, and reporting
  • nDepth log storage, search, and analysis
  • Log collection

The following diagram shows four LEM VM instances. One each for the LEM Manager, syslog collection, the normalized data store, and an optional original data store.

Deploying each LEM VM on separate hardware increases performance. You can also deploy multiple VMs on the same hardware host with minimal negative performance impacts.

LEM allows you to assign resources in different ways based on your organization's needs. For example, you can deploy two LEM Managers, each on a separate VM, if your organization has logical divides in management and/or monitoring responsibilities.

In the above example, a single LEM console provides a consolidated, real-time search and management view across two LEM VMs.

See also: