Reducing Logfiles loading time

[MRO3]

Hi
We use a pentium 4 system for rurning actix

how we could reduce the loading time , because number of logfiles are too much and it always takes alot of time!?

do u know if actix can use dual core processors completly?!
tnx

[fon909]

You can use Network Image for processing large files

[stilloboy]

You can use Network Image for processing large files

Yes, this is correct especially when you only select the attributes and queries that you need for your analysis. You can also squeeze an ounce off the processing time if you increase the value for the "binning time", when creating a network image template, from the default value of 1000ms to say 1200ms. The effect is to make the data aggregation process more coarse.

WR

[elhape]

pentium 4? within this day?
oww man :D

[stilloboy]

Hi
We use a pentium 4 system for rurning actix

how we could reduce the loading time , because number of logfiles are too much and it always takes alot of time!?

do u know if actix can use dual core processors completly?!
tnx

Of course, Actix is completely compatible with dual-core processor machines. In fact, the processing speed increases with this configuration. So, I suggest that you switch to a dual-core processor system, if you can afford to.

WR

[Rooster[BG]]

Faster hardware (CPU, RAM, HDD) will decrease the the load time. Dual core is almost a must since with one core when Actix loads data uses 100% and you can't do anything else.
I'm using x64 bit system with Intel CPU that support HT (4 threads with two physical cores) and I can't find any difference with CPU that supports only two threads. Since Actix is not 64bit, the only use of x64 OS is the ability to have more RAM.

You can disable loading of scanner data if you don't need it and this will help reduce the load time. However you can't load more log files with this option than without it (Actix statement).
There are two other options that can probably affect the loading speed, but all of these options will change the results of the queries, and other data manipulation.
The options are: "Load Speed Default" and "Disable Scanner Load Time Message Filtering". You can check them in Actix help for more information.


For large amounts of log files, it is best to use Network Image or Repository.

[MRO3]

would u please describe more about network image

[Rooster[BG]]

Network Images extract the most commonly used network parameters and store them in an external file (*.dat). This is useful when you are performing a system-wide analysis or benchmarking activity. Because only key parameters are saved into the Network Image file, this file is much smaller than the sum of its component files.
A Network Image populated with data is saved as a separate, smaller file from the original logfile. The original logfile is not altered in the creation of a Network Image repository.
The data contained in a Network Image file differs from normal logfiles, in that the image file contains only the parameters specified and is binned according to the image template. Some pre-configured Network Image templates are packaged with the Actix software. It is also possible to create custom Network Image.

This is an extract from an Actix document, I think it gives a little perspective.

It will take you some time to load all your files, but after creating the image you can "attach" it to Actix in a seconds or distribute it to another PC.


would u please describe more about network image