Manager Scalability and Performance

The Manager scales from small deployments (1–25 Sensors) to large enterprise deployments (100–200 Sensors).

• Event ingestion: All Sensors log to local Unix socket → Sensor adapter → message queue.

• Stream analytics: The analytics engine consumes the message queue and performs real-time behavioral analysis.

• Storage layer: Hot data uses full text indexed storage (recent events, fast search). Warm/cold data uses columnar database storage (long-term retention, cost-optimized analytics).

• Manager size:

• Add Manager nodes for horizontal scale.