Environment

ArcSight Logger version X

Situation

There is no limitation on the number or type of receivers, or its maximum throughput. However, adding more than 40 to 50 receivers may affect performance. A high incoming event rate and large event size can affect the performance of a receiver. The recommended maximum total events per second (EPS) incoming rate is 15K

Note: L8000 Logger Appliances are capable of handling a higher ingestion rate, of up to 30k EPS. 

The connectors that send events to the Logger may have limits on their throughput. To monitor the event flow on each receiver through alerts and for better granularity in searches, use an individual receiver for each connector sending events to Logger. Do not reuse deleted receiver names. Logger retrieves old device information when conducting a device search. As with other considerations related to scope, questions about how to configure receivers and how many connectors should send data to any given receiver, are best answered when taking the entire environment into consideration (data type, usage requirements, and so on). 

Find resolution on support portal