Virtual Host Installation: Task 2. Review Optimal Datastore Space Configuration

Document created by RSA Information Design and Development on Apr 10, 2019Last modified by RSA Product Team on Nov 4, 2019
Version 9Show Document
  • View in full screen mode

You need to review the datastore space configuration options for the different hosts to get the optimal performance from your virtual NetWitness Platform deployment. Datastores are required for virtual host configuration, and the correct size is dependent on the host.

Note: (1.) Refer to the "Optimization Techniques" topic in the RSA NetWitness PlatformCore Database Tuning Guide for recommendations on how to optimize datastore space. (2.) Contact Customer Care for assistance in configuring your virtual drives and using the Sizing & Scoping Calculator.

Virtual Drive Space Ratios

The following table provides optimal configurations for packet and log hosts. Additional partitioning and sizing examples for both packet capture and log ingest environments are provided at the end of this topic.

Decoder
Persistent 
Datastores
Cache Datastore
PacketDBSessionDBMetaDBIndex
100% as calculated by Sizing & Scoping Calculator6 GB per 100Mb/s of traffic sustained provides 4 hours cache60 GB per 100Mb/s of traffic sustained provides 4 hours cache3 GB per 100Mb/s of traffic sustained provides 4 hours cache

 

Concentrator
Persistent 
Datastores
Cache Datastores
MetaDBSessionDBIndex
Calculated as 10% of the PacketDB 
required for a 1:1 retention ratio
30 GB per 1TB of PacketDB for standard multi protocol network deployments as seen at typical internet gateways5% of the calculated MetaDB on the Concentrator. Preferred High Speed Spindles or SSD for fast access

 

Log Decoder
Persistent 
Datastores
Cache Datastores
PacketDBSessionDBMetaDBIndex
100% as calculated by Sizing & Scoping Calculator1 GB per 1000 EPS of traffic sustained provides 8 hours cache20 GB per 1000 EPS of traffic sustained provides 8 hours cache0.5 GB per 1000 EPS of traffic sustained provides 4 hours cache

 

Log Concentrator
Persistent 
Datastores
Cache Datastores
MetaDBSessionDBIndex
Calculated as 100% of the PacketDB 
required for a 1:1 retention ratio
3 GB per 1000 EPS of sustained traffic per day of retention5% of the calculated MetaDB on the Concentrator. Preferred High Speed Spindles or SSD for fast access

 

 Endpoint Log Hybrid
 MetaDBPacketDBSessionDBIndex

Total

Log Decoder

120 GB26 GB6 GB

NA

152 GB
Concentrator206 GBNA6 GB4 GB

216 GB

MongoDBNANANANA

13 GB (12 GB tracking data, 1 GB scan data)

Note: The above Endpoint Log Hybrid sizing guidelines are for 20 K agents and 20 K events per day per agent with an event size of 1500 bytes.
The same sizing guidelines are applicable for scan data with 20 K sessions per day per agent except MongoDB as mentioned above.

 

You are here

Table of Contents > Install SA Virtual Host in Virtual Environment > Step 3. Configure Datastore Space > Task 2. Review Optimal Datastore Space Configuration

Attachments

    Outcomes