{= include("docs.util"); start_docs_page(docs.technical_manual.page_titles.newsletters); =}

Sawmill Newsletter

December 15, 2010

Welcome to the Sawmill Newsletter!

You're receiving this newsletter because during the downloading or purchase of Sawmill, you checked the box to join our mailing list. If you wish to be removed from this list, please send an email, with the subject line of "UNSUBSCRIBE" to newsletter@sawmill.net (please include the entire message, as the identifying information is at the bottom).

News

Sawmill 8.1.7 shipped on October 13, 2010. This is a bug-fix release—it fixes a few bugs. It also fixes a serious security vulnerability which potentially allows remote attackers to execute arbitrary code on the Sawmill server. This release is free to existing Sawmill 8 users. Because of the security issue, this release is recommended for anyone using Sawmill 8.1.5 or Sawmill 8.1.6 (earlier versions are not affected by the vulnerability), or users of earlier version who are experiencing the issues described in the 8.1.7 version history. You can download Sawmill 8.1.7 from http://sawmill.net/download.html .

Sawmill 7 users can upgrade to Sawmill 8 for half of the license price; or if you have Premium Support, the upgrade is free. Major features of Sawmill 8 include support for Oracle and Microsoft SQL Server databases, real-time reporting, a completely redesigned web interface, better multi-processor and multi-core support, and role-based authentication control.

This issue of the Sawmill Newsletter describes the creation of a cluster of parsing servers to improve the performance of log processing to omit rows of reports as they are displayed.

Get The Most Out Of Sawmill With Professional Services

Looking to get more out of your statistics from Sawmill? Running short on time, but need the information now to make critical business decisions? Our Professional Service Experts are available for just this situation and many others. We will assist in the initial installation of Sawmill using best practices; work with you to integrate and configure Sawmill to generate reports in the shortest possible time. We will tailor Sawmill to your environment, create a customized solution, be sensitive to your requirements and stay focused on what your business needs are. We will show you areas of Sawmill you may not even be aware of, demonstrating these methods will provide you with many streamlined methods to get you the information more quickly. Often you'll find that Sawmill's deep analysis can even provide you with information you've been after but never knew how to reach, or possibly never realized was readily available in reports. Sawmill is an extremely powerful tool for your business, and most users only exercise a fraction of this power. That's where our experts really can make the difference. Our Sawmill experts have many years of experience with Sawmill and with a large cross section of devices and business sectors. Our promise is to very quickly come up with a cost effective solution that fits your business, and greatly expand your ROI with only a few hours of fee based Sawmill Professional Services. For more information, a quote, or to speak directly with a Professional services expert contact consulting@flowerfire.com.

Tips & Techniques: Using Remote Parsing Servers

Sawmill Enterprise supports the use of multiple processors during the log parsing phrase of a database build, to improve performance over single-threaded parsing. Depending on the number of processors in the server, this can improve parsing performance by a factor of 2, 4, 8, 16, or more.

If higher performance is required, Sawmill Enterprise also allows the profile to use external parsing servers, running on other servers, to handle the parsing load in parallel. This news letter describes the process of configuring these parsing servers, and configuring the main Sawmill installation to use them.

Installing And Configuring Parsing Servers

Each parsing server machine needs its own installation of Sawmill (with its own license). So start by installing and licensing Sawmill on each parsing server machine.

Then copy the profile you want to distribute, from the "profiles" folder of the LogAnalysisInfo folder of your main Sawmill installation, to the "profiles" folder of the parsing server installation.

Start each parsing server from the command line:

\$ ./sawmill -p profile -a sps -psp port -psh server-ip

For instance, if the parsing server is running on a machine with IP 10.0.1.2, and the internal name of the profile you're distributing is "my_profile", you could use this:

\$ ./sawmill -p my_profile -a sps -psp 9001 -psh 10.0.1.2

This starts the parsing server, binds it to port 9001 of 10.0.1.2, and configures it to handle requests for the profile "my_profile."

You'll need to do this for each separate parsing server you want. If the parsing server machine has multiple processors, you'll probably want to start a parsing server for each processor, each with a different port number (e.g., 9001, 9002, 9003; you can choose any available port).

For ease of maintenance, it may be simplest to write a script to start all parsing servers, perhaps at boot time.

Configuring The Main Profile

Once the parsing servers are running, you can link to them from the main profile, in Config -> Log Processing -> Distributed Processing:

Parsing Server Configuration In The Main Profile

In the example above, the profile is configure to start four local parsing servers (127.0.0.1) automatically, and to use those together with four remote parsing servers (which must be started manually as described above). This profile will parse using eight "processors," four of them on the local machine, and four of them on 10.0.1.2.

After doing this configuration, all database rebuilds and database updates will automatically use all eight of these parsing servers, splitting the log processing section into eight equal parts and distributing each part to a separate process. This can give up to an 8x performance improvement for this stage of the database build/update (index building, cross-reference building, and session calculation are not affected, as they are run locally with a single thread).

Any number of parsing servers can be used, so using this method, you can create a cluster of parsing servers, with multiple processors on multiple machines, for the highest performance.

Professional Services

This newsletter describes remote parsing servers. If you need assistance with implementing or configuring remote parsing servers, or with any other Sawmill tasks, our Sawmill Experts can help. Contact sales@sawmill.net for more information.

[Article revision v1.0]
[ClientID: 43726]

{= end_docs_page() =}