Performance
Measured with the load tests in loadtest (SIEMLITE_LOAD=hard) on one small machine: an AMD Ryzen
Embedded R2544 (4 cores, 8 threads), 14 GB of memory and an SSD, with the database on that SSD. Each figure is the 95th
percentile with many clients working at once.
The table below is version 0.7, which kept every event in one file, at 5 million events. Version 0.8 stores one file per
day, and stores batches with multi-row inserts and one text-index update per batch, which made storing about four
times faster. Measured on the small tier (500,000 events across 30 days, 8 senders): logs over HTTPS 19,500 events/s
stored and searchable, TCP syslog 21,000 lines/s, filling storage directly 31,000 events/s, searches 6-170 ms, results
5,001-5,100 about 450 ms, the dashboard 65 ms, the first alert check under 1 s, and backup and restore 4 s and 2 s.
| Workload | Result |
|---|---|
| Logs over HTTPS, 32 apps sending 500-line batches at once | 4,600 events/s accepted, 3,700/s stored and searchable (about 320 million a day) |
| Syslog over UDP at 4,000 messages/s for 75 s | 300,000 of 300,000 stored |
| Syslog over TCP, 4 senders as fast as they can | 4,100 lines/s stored, none lost |
| Search 5 million events (2.4 GB), 16 people at once: newest page, a common word, an address, a user | 4-27 ms |
| ... a phrase, three words with AND, a host and severity | 28-80 ms |
| ... a word within one day, results 5,001-5,100 | 190-200 ms (a user limited to some sources: up to 530 ms) |
| Dashboard over 5 million events | 1.4 s |
| Alert rules, first check of all 5 million events | 7 s |
| Backup of 5 million events (684 MB compressed) / restore | 33 s / 21 s |
When senders outpace storage, SIEMLite answers 503 with Retry-After and how many lines it kept, so nothing is
lost silently; UDP syslog has no way to push back, so keep its rate under what storage sustains.
Version 0.7 made search much faster on large databases. On 500,000 events with 8 people searching at once:
| Search | v0.6 | v0.7 |
|---|---|---|
| A common word | 2,330 ms | 20 ms |
| Results 5,001-5,100 for a common word | 3,131 ms | 78 ms |
| An address | 299 ms | 1 ms |
| A host and severity, by a user limited to some sources | 960 ms | 41 ms |