1. r11 Event Management Scalability Tests -

2. © 2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies. Objectives -To run scalability tests to ascertain scalability limits such as the number of events that can be processed with different MRA, impact of AMS, AEC, etc

3. Test 1 -MRA Processing on Local Node

4. © 2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies. Test 1 - Goal -Analyze impact of MRA with different levels of Message Storm. -Any MRA with the exception of FORWARD or ALERT

5. © 2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies. Test 1a – Half Million -Generate message storm with half a million events and review latency period on the last event -MRA = SendOper -This is to simulate event storm that may be generated by back bone router going down

6. © 2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies. Test 1a - 500,000 Events Storm with SendOper MRA Latency: 2 mins 26 seconds

7. © 2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies. Test 1a -Confirm half millions events processed by Event Management

8. © 2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies. Test 1b - 250,000 Events Storm with SendOper MRA 125,000 Events Latency 40 seconds 50,000 Events Latency 21 seconds

9. © 2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies. Test 1b - 250,000 Events Storm with SendOper MRA 250,000 Events Latency 74 seconds

10. © 2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies. Test1b - Repeated -Repeat Test1b on a different server to verify the latency period is consistent

11. © 2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies. Test1b - Repeated 250,000 Events Latency 74 seconds 50,000 Events Latency 21 seconds

12. © 2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies. Conclusion -MRA without Forward can process approximately half million events message storm with last event latency of approx 2 mins. -50,000 Event message storm has no significant delay

13. Test 2 -MRA processing on local node with steady flow of events

14. © 2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies. MRA Test -Generate 500 events per second and process one MRA for each on the local node -Analyze if any latency

15. © 2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies. Generate 500 events per second

16. © 2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies. 500 Events Per Second First Last No Latency

17. © 2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies. MRA Test -Generate 500 events per second and process two MRA per event on the local node -Analyze latency

18. © 2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies. 2 MRA Test – 500 Events per Second Confirms no latency by adding extra MRA

19. © 2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies. MRA Test -Generate 1800 events per second and accelerate by 10% compound every 30 second -Analyze latency

20. © 2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies. Accelerated Event Storm

21. © 2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies. One Minute Analysis

22. © 2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies. Latency LastFirst 860010 events in 345 seconds, average of 2495 events per seconds

23. © 2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies. Conclusion -2495 events per second for local node MRA processing with exception of Forward, Alert or command

24. Test 3 -Event Storm Forward to Central Node

25. © 2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies. Test 3 - Goal -Analyze impact of FORWARD MRA with different levels of Message Storm. - On the central console, “No ALERTS” (AMS)

26. © 2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies. r11 Configuration Server_229Server_230Server_405 Central Server Event Agent

27. © 2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies. Central Server Machine Spec

28. © 2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies. Test 3 -Forward One Million Events from Server 229 to Central Console -At the same time forward another million Events from Server 230 to Central Console

29. © 2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies. Shows 1 million events each from 2 nodes

30. © 2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies. Latency – 2 Millions Forward -One million events forwarded from each of the 2 servers. In total 2 millions events forwarded to the central node. Latency of 1 hour 12 mins Server 229 Server 230

31. © 2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies. Conclusion -Forward MRA can process 1 million events each from 2 different server but will have significant delay

32. Test 4 -Steady Flow Events with Forward to Central Node

33. © 2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies. Test 4 - Goal -Analyze impact of FORWARD MRA with accelerated Event Message storm - On the central console, “No ALERTS” (AMS)

34. © 2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies. Test 4 -Generate 200 events per second from each server and accelerate the rate by 20 events every 60 seconds.

35. © 2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies. Generate Message Storm Server 229 Server 230

36. © 2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies. Confirm Counts

37. © 2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies. Reports shows Events per minute

38. © 2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies. 5 mins – Server One -In 5 mins 30 seconds, 72,300 events forwarded from Server 230. -Average 220 events per seconds forwarded from server 230 Server 230 Accelerated rate of 300 Latency: 30 seconds

39. © 2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies. 5 mins - Server Two -In 5mins, 72,300 events forwarded from Server 229 and in total 144600 events received by the central node. -Average 433 events per second received by the central node Server 229 Accelerated rate of 300 Latency: 31 seconds

40. © 2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies. 10 mins - Server One -In 13 mins, 74000 events forwarded from Server 230. Server 230 Latency 3 min 16 secs Accelerated rate of 380 per second

41. © 2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies. 10 mins - Server Two -In 13 mins, 174000 events forwarded from Server 229, average of 220 events per second -348,000 Events received by the central node in 13 minutes, average of 437 events per second Server 229 Latency 3 min 16 secs Accelerated rate of 380 per second

42. © 2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies. Events processed per minute This shows the number of events received by the central node

43. © 2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies. Conclusion -In 13 mins, 174000 events forwarded from each node. -The maximum latency of 3 mins 16 seconds -On Average, 220 events per second can be forwarded from each node without any delay -Analysis of Events processed per minute shows on average of 445 events per seconds received by the central node.

44. Test 4 Extension -“Forward” MRA

45. © 2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies. Test 4 Extension -Test 4 confirms 440 events per second received from 2 nodes. -Does this mean, one can FORWARD 440 events per second from a single node only? -No!!!. - If you forward 440 events from one node, you will experience significant latency

46. © 2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies. Test 4 Extension -Generate a steady flow 221 events per second and forward it to a central node

47. © 2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies. Test 4 Extension Shows 221 events per second forwarded from a single node to the central node with latency of 9 seconds

48. © 2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies. Test 4 Extension -Generate 440 events per second from a single node and forward it to the central node. -No events forwarded from any other nodes except this one.

49. © 2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies. Generate 440 Events per second

50. © 2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies. 440 Event per second Forward from one Node 78581 events in 6 minutes, generating average of 218 events per second

51. © 2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies. Conclusion -Average of 220 events per second can be forwarded from each node.

52. Test 5 -“ALERT” MRA

53. © 2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies. Test 5 - Goal -Analyze impact of ALERT MRA -Test5a – Event Storm 10,000 events -Test5b – 20 events per second with Consolidate

54. © 2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies. DIA Zones

55. © 2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies. MCC Alert Queue Display

56. © 2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies. Alert MRA

57. © 2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies. Alert Queues

58. © 2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies. Test4a –10,000 Events Storm with Alert MRA After 1000 Events Latency : 37 Seconds

59. © 2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies. Test4a –10,000 Events Storm with Alert MRA After 2500 Events Latency : 3 mins 4 seconds

60. © 2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies. Test4a –10,000 Events Storm with Alert MRA 10,000 Events Latency of approx 34 mins

61. © 2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies. Conclusion -If message storm is expected, another layer to handle message storm should be used. That layer should handle the message storm. Example, use AEC to handle message storm and get AEC to generate message which triggers ALERT MRA

62. Test 5b -“ALERT” MRA -Controlled Rate

63. © 2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies. Test 5b – Controlled Rate -Generate 20 events per second for 60 seconds.

64. © 2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies. Alert Queue - Consolidate -Events on the Alert Queue are consolidated to cut down the number of entries on MCC

65. © 2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies. Test 5b – After 800 events Latency of 67 seconds

66. © 2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies. Test 5b – After 1200 Events Latency: 2 mins 49 seconds

67. © 2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies. Conclusion -For ALERT MRA, filtering should be used if message storm is expected.

68. © 2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies. Conclusion -2495 events per second for local node MRA processing with exception of Forward, Alert or command -On Average, 220 events per second can be forwarded from each node without any significant delay -Message storm of 50,000 events has no significant delay -250,000 events storm is handled with latency of approx 74 seconds. -500,000 message storm is handled with latency of approx 2 mins on the last event

69. © 2005 Computer Associates International, Inc. (CA). All trademarks, trade names, services marks and logos referenced herein belong to their respective companies. Questions?? -Mail to: -Yatin Dawada -Yatin.Dawada@ca.comYatin.Dawada@ca.com -Bill Merrow -Bill.Merrow@ca.comBill.Merrow@ca.com