You need to review the datastore space configuration options for the different hosts to get the optimal performance from your virtual NetWitness Platform deployment. Datastores are required for virtual host configuration, and the correct size is dependent on the host.
Note: (1.) Refer to the "Optimization Techniques" topic in the RSA NetWitness PlatformCore Database Tuning Guide for recommendations on how to optimize datastore space. (2.) Contact Customer Care for assistance in configuring your virtual drives and using the Sizing & Scoping Calculator.
Virtual Drive Space Ratios
The following table provides optimal configurations for packet and log hosts. Additional partitioning and sizing examples for both packet capture and log ingest environments are provided at the end of this topic.
Note: The above Endpoint Log Hybrid sizing guidelines are for 20 K agents and 20 K events per day per agent with an event size of 1500 bytes.
The same sizing guidelines are applicable for scan data with 20 K sessions per day per agent except MongoDB as mentioned above.