We have an ESXi-virtualized Kiwi server with 2 x 2.5 GHz vCPUs and 8 GB of memory allocated to it. On a busy day, this is capturing over 120 million messages (~30 GB) with CPU utilization just under 50%. Not sure of peak message volumes.
However
- the server is only logging to flat files (max 1 GB each);
- forwarding is limited to Emergency and Alert priority messages to Orion;
- we don't have any other filters and we don't log to display;
- message buffer size has been increased to 10 million;
- Kiwi Web Access isn't even installed - it was useless with such high volume and sucked processor;
- message buffer size has been increased to 10 million;
In our case, the primary use of Kiwi is to capture to disk for audit purposes. It is not used as a real-time debugging or analysis tool.
Just in case anyone is interested, we use a PowerShell script to archive and delete logs according to the date embedded in the log file names. This ensures that all logs for one day (give or take a few seconds at log rotation) are bundled together in a single ZIP. You can't do that properly with the built-in archiving feature. If you're interested, let me know.