Complex deployment example with multiple SEM VMs

To increase performance, you can divide SEM's workload across multiple SEM VMs. Each VM can be configured to provide dedicated processing for tasks such as:

  • Management and event analysis
  • Database storage, search, and reporting
  • Log storage, search, and analysis
  • Log collection

Although multi-VM SEM installations are possible, SEM deployments typically perform well as a single appliance that you can scale up by dedicating additional resources from the virtual host.

Each SEM VM can specialize and provide dedicated processing for one or more of the following:

  • Management and event analysis
  • Database storage, search, and reporting
  • nDepth log storage, search, and analysis
  • Log collection

The following diagram shows four SEM VM instances. One each for the SEM Manager, syslog collection, the normalized data store, and an optional original data store.

Deploying each SEM VM on separate hardware increases performance. You can also deploy multiple VMs on the same hardware host with minimal negative performance impacts.

SEM allows you to assign resources in different ways based on your organization's needs. For example, you can deploy two SEM Managers, each on a separate VM, if your organization has logical divides in management and/or monitoring responsibilities.

In the above example, a single SEM console provides a consolidated, real-time search and management view across two SEM VMs.

See also: