How does Non-Events handle high-volume environments (millions of messages/day)?
Architecture optimized for scale:
- Evaluation efficiency: Non-Events queries Log Views (SQL WHERE clauses with indexed Search Fields), not full table scans. Query: "SELECT COUNT(*) FROM LogEvents WHERE MessageType = 'PurchaseOrder' AND Timestamp >= '2024-10-16 14:00' AND Timestamp < '2024-10-16 15:00'" (indexed columns, sub-second execution on 100M+ row tables)
- Interval-based evaluation: Agent evaluates on schedule (every 5 min, 15 min, 1 hour), not per-message (avoids per-event overhead). High volume: 10M orders/day = 416K/hour average, Non-Events evaluates 96 times/day (15-min intervals) = 96 SQL queries/day (negligible DB load)
- Statistics aggregation: Pre-aggregated hourly/daily statistics stored in separate tables (not re-querying raw log data), fast monthly report generation (query 720 hourly stats rows vs. 10M raw log rows)
- Database partitioning: Log databases partitioned by Message Type + month (faster queries on filtered subsets, parallel evaluation of multiple Non-Events resources)
- Agent scalability: Multiple Non-Events Agent instances (load balanced), each evaluates subset of resources (horizontal scaling)
Production example: Healthcare EDI company logs 15M HL7 messages/day (180M/month, 2.16B/year). 47 Non-Events resources monitoring (hospital admission volumes, lab order confirmations, patient discharge notifications, billing claim acknowledgments). SQL Server Enterprise with columnstore indexes, table partitioning by month, 4 Non-Events Agent instances (each evaluates 12 resources). Average evaluation time: 1.8 seconds per resource per interval (15-min intervals), total DB CPU: 7% average, peak 14% during month-end statistics generation.
Next Step
Need more help? Check the Troubleshooting Overview for all FAQs, or refer to the Configuration Guide to fine-tune your Non-Events monitoring setup.