Telemetry is written all day in huge volumes, never changed once written, and read rarely: AI agents query it in short bursts during an investigation, not dashboards refreshing all day. So ingest is the hard part: every record has to be taken in at full rate, without loss, on as little hardware as possible.
No loss to a higher rate, on a fraction of the memory
| Measure | FFWD UC | Market Leader | UC advantage |
|---|
"No loss": not a single record lost. Memory is the average over the 2 minutes at each one's highest no-loss rate.
Same records, same parsing, same limits
- 1
Send the same records
About 270-byte syslog records over UDP, each numbered.
- 2
Parse every record
Identical parsing in both collectors.
- 3
Raise the rate
Two minutes per rate, on a fresh collector.
- 4
Add cores
Repeated on 2 and 4 cores.
The same for both
- 1 GB memory per core
- 4 MB UDP receive buffer
- Same server sizes and CPU
Every rate in Addendum A; setup in Addendum B.
Detailed test results
AEvery rate up to the break point
Each collector's rates up to the first one where it lost any records. Each rate ran for 2 minutes on a freshly started collector, after an unmeasured 30-second warm-up. All lost records were dropped at the collector's UDP socket. Memory is the average over the 2 minutes, peak in brackets.
| Collector | Cores | Rate sent | Delivered per second | Lost | Memory |
|---|
BTest setup
- Servers
- AWS c8a (AMD EPYC 9R45, 4.5 GHz, one full core per vCPU): c8a.2xlarge or c8a.4xlarge for the collector, always with the same per-collector core and memory limits; c8a.xlarge for the sender and receiver, all in one AWS subnet. Collectors use the host's network directly
- FFWD UC
- core0's Universal Collector data path as deployed: its UDP receiver, its processing engine with the configuration the UC agent generates, and its production output to the FFWD gateway (gRPC, compressed and encrypted)
- Market Leader
- Current release in November 2026, official container image, a single instance with one worker process per core and the product's minimum memory setting per worker. Syslog over UDP with a 4 MB receive buffer, the same parsing, and output as uncompressed JSON over HTTP
- Parsing check
- Sampled records from both collectors were checked field by field against the record sent; all were correct (4,000 UC records and 7,080 Market Leader records)
- Records
- RFC 5424 syslog with a key=value body of about 270 bytes; every value varies per record so nothing can be cached
- Receiver
- Accepts each collector's real output protocol and counts every record by sequence number; it runs outside the collector's limits