This is a note my client sent:
I can’t really use the logs from Splunk, because they are spotty.. Think I figured out why it’s missing data though. From our last meeting, they bumped up the transfer rate from 1024KBps to 2048KBps because the CE was generating too much data. However, the CE raw logs generate roughly about 75MB/Minute or 1.25MBps raw. Since Splunk does use compression at ~17%, the 2KBps gets you about 11KBps raw. The 1.25MBps is roughly 217.6KBps compressed. Hence, it gives you roughly 5% of the total logs. To support Openway and prevent dropping any logs, we need to set a conservative rate to handle 110MB/minute raw, which would be ~319KBps.
We did set in the limits.conf to the 2048 mentioned above, but we're not certain how to set to a level the client needs.
