Choosing a Log Server hardware

This support forum board is for support questions relating to Nagios Log Server, our solution for managing and monitoring critical log data.
Locked
vmesquita
Posts: 315
Joined: Fri Aug 10, 2012 12:52 pm

Choosing a Log Server hardware

Post by vmesquita »

Hello,

We just bought our Nagios Log Server License and need to decide about the server specifications. Does Log Server benefit substancially from a physical server (like NAGIOS) or using a virtual machine is OK? Are there any guidelines on how to choose the ideal hardware?
jolson
Attack Rabbit
Posts: 2560
Joined: Thu Feb 12, 2015 12:40 pm

Re: Choosing a Log Server hardware

Post by jolson »

I have a lot of experience with Nagios Log Server, and I can tell you the following.

There are no hard and fast hardware recommendations - unfortunately due to the nature of Nagios Log Server there is no 'one size fits all' solution.

I will need a few questions answered so that I may provide you with better insight:

How much data do you plan on pushing into Nagios Log Server daily? (an estimate is okay).

How fast are your disks with regards to virtual machines? If they're at least as fast as physical disks, you would be fine using either a physical server or a virtual machine (I have seen large and successful installations on both types of server).

How many instances do you plan on deploying?
Twits Blog
Show me a man who lives alone and has a perpetually clean kitchen, and 8 times out of 9 I'll show you a man with detestable spiritual qualities.
vmesquita
Posts: 315
Joined: Fri Aug 10, 2012 12:52 pm

Re: Choosing a Log Server hardware

Post by vmesquita »

Hi Jolson,

We made an estimate, and I guess the data volume should be something between 10 and 20 Gb. The disks we were planning to use were slower than physical disks, however we have also the possibility of moving it to a faster storage, if it would give a significante improve in performance.

We will be deploying 2 instances.
jolson wrote:I have a lot of experience with Nagios Log Server, and I can tell you the following.

There are no hard and fast hardware recommendations - unfortunately due to the nature of Nagios Log Server there is no 'one size fits all' solution.

I will need a few questions answered so that I may provide you with better insight:

How much data do you plan on pushing into Nagios Log Server daily? (an estimate is okay).

How fast are your disks with regards to virtual machines? If they're at least as fast as physical disks, you would be fine using either a physical server or a virtual machine (I have seen large and successful installations on both types of server).

How many instances do you plan on deploying?
jolson
Attack Rabbit
Posts: 2560
Joined: Thu Feb 12, 2015 12:40 pm

Re: Choosing a Log Server hardware

Post by jolson »

We made an estimate, and I guess the data volume should be something between 10 and 20 Gb.
Based on that, I recommend *at least* the following server specs:

16GB RAM per node (32GB if possible)
2 CPUs (4 if possible)
At least 2 instances (4 if possible)
~500GB HDD space per node, depending on how long you want to retain data. It's good to know that if you push 10GB of data into Nagios Log Server, 20GB of data will be generated (for failover purposes).

I recommend starting with the minimum amount of specs listed above (2 instances with 2 CPUs and 16GB of RAM each) - you can scale your resources up accordingly. You will certainly notice if the load is too much for your instances to handle - the Web GUI will slow down, and elasticsearch/logstash might quit. The first thing that I would expand is your memory (up to a very maximum of 60GB per node) - the second thing I would expand is the instance count.

Start small, you can always scale up as necessary.
Twits Blog
Show me a man who lives alone and has a perpetually clean kitchen, and 8 times out of 9 I'll show you a man with detestable spiritual qualities.
Locked