Sumo Logic Installed Collectors are lightweight and efficient. You can choose to install a small number of Collectors to minimize maintenance or just because you want to keep your topology simple. Alternatively, you can choose to install many Collectors on many machines to distribute the bandwidth impact across your network rather than having it centralized.
In addition, you'll want to consider Sumo Logic Hosted Collectors, which reside in the Cloud, allowing for seamless collection from Amazon S3 buckets and HTTP Sources.
For information on local vs. centralized data collection see Best Practices: Local and Centralized Data Collection.
Installed Collectors are deployed in your environment, on a local machine, a machine in your organization, or even an Amazon Machine Image (AMI). Installed Collectors require a software download and installation. Upgrades to Collector software are released regularly by Sumo Logic.
Consider having an Installed Collector on a dedicated machine when:
- You are running a very high-bandwidth network with high logging levels.
- You want a central collection point for many Sources.
Consider having more than one Installed Collector if:
- You expect the combined number of files coming into one Collector to exceed 500.
- Your hardware has memory or CPU limitations.
- You expect combined logging traffic for one Collector to be higher than 15,000 events per second.
- Your network clusters or regions are geographically separated.
- You prefer to install many Collectors, for example, one per machine to collect local files.
Unlike Installed Collectors, Hosted Collectors don't require installation or activation, nor do Hosted Collectors have physical requirements, since they're hosted in AWS.
Because there are no performance issues to consider, you can configure as many S3 and HTTP Sources as you'd like for a single Hosted Collector. Consider setting up more than one Hosted Collector if you'd like to tag different data types with different metadata.
A note about logging levels
The more sensitive the logging level settings are for your applications and devices, the more logs will be sent to the Sumo Logic Cloud. In order to maximize the value of your log collection and analysis, set the logging level as high as you can without negatively impacting the CPU utilization of the machine where the Collector is running. The more searchable data you collect, the more information you have for forensic analysis and troubleshooting.
If you have additional questions, a Sumo Logic sales representative can help determine specific recommendations for your installation.