Virtual Log Collectors FAQ

This information answers frequently asked questions (FAQs) about Arctic Wolf® Virtual Log Collectors (vLCs). Contact your Concierge Security® Team (CST) at security@arcticwolf.com if you have questions that are not answered here.

Q: How many Virtual Log Collectors do I need to deploy for a specified number of log sources?

A: A Virtual Log Collector (vLC) can process a variable number of log lines per second, based on factors such as:

  • The complexity of the given log lines.

  • The number of log producing sources.

  • The allocation of resources from the host to the VM.

Typically, a single CPU core can handle approximately 7000 log lines/second. This would equate to the following estimates for the vLC variant:

Model

Cores

Log Processing Capacity

v100 (includes all platforms and environments, such as AWS, Azure, and Nutanix)

2

14,000 logs/second