KBI 312102 Issue Addressed: High CPU Usage When Monitoring SYSLOG Messages

Version

Argent Omega 2.2A-2307-A and earlier

Date

Monday, 2 October 2023

Summary

CPU usage can spike constantly when running Relators with SYLOG Message Rule.

It is especially obvious with a busy network with more than a hundred SYSLOG messages received every minute.

The issue has been addressed in Argent Omega 2.2A-2307-B (Build: 2.2.2310.2)

Technical Background

Argent Omega Generator collects SYSLOG messages and saves in SYSLOG subfolder.

In Argent Omega 2.2A-2307-A or earlier, all messages go to a single file.

As results, the file can grow very large. By default, it rolls over every 5 Megabytes.

When Argent Omega runs SYSLOG Rule, it scans the files to pick up matching messages.

When there are many of the files and file sizes are large, the scanning performance deteriorates.

Argent Omega 2.2A-2307-B has been enhanced to address the issue. Subfolders under SYSLOG are created, one for each network device.

As results, significant smaller amount of files is needed to scan.

Resolution

Upgrade to Argent Omega 2.2A-2307-B (Build: 2.2.2310.2) or later

For further assistance, please contact Argent on Instant Help at
https://Instanthelp.Argent.com/