Hello,
I saw in the documentation that it is possible to configure the “parser_routines”, “buckets_routines” and “output_routines” parameters. (CrowdSec Tour | CrowdSec)
What does the “1000 EP/s” correspond to ?
How do I know if the _routines parameters need to be increased ?
Thanks in advance for your help !
Hi @CIS,
‘1000 EP/s’ means 1k events processed per second. You starts increase the routine when you starts having a lot of logs to process. For example on a log centralization setup, if crowdsec is running on the server that acquire all servers logs, you need to check how many events logs you have per second and configure the parsers et buckets routine to adapt.
You can also adjust those parameters when crowdsec starts having some lag on the logs it process, it means lot of logs and not enough parallelism.