Storage: Storage Requirements

Document created by RSA Information Design and Development Employee on Jan 30, 2020Last modified by RSA Information Design and Development Employee on Sep 8, 2020
Version 13Show Document
  • View in full screen mode
 

Storage Requirements

This section contains all the storage requirements needed to successfully attach storage to your NetWitness Platform deployment host systems. It contains the required drive types, appropriate volumes, and performance IOPS that are needed.

Drive Specifications

General specifications for core NetWitness Platform Hosts are:

  • IO size 490/Dec
  • Response/Latency < 20ms
  • Decoder 10/90 read/write (low random I/O)
  • Concentrator 50/50 read/write (high random I/O)
                   
RAID GroupSuitable Volumes
NL-SAS or 10K SAS

All Packet Decoder volumes

All Log Decoder volumes

All Archiver volumes

Concentrator meta volume

SSDConcentrator index volume

Required NetWitness Platform Storage Volumes

Service Volume Names

                                                

Service

Volume NameFile Systems Created
Network Decoder decoder packetdb
Network Decoderdecodersmalldecoder root, index, sessiondb, metadb
Log Decoderlogdecoder packetdb
Log Decoderlogdecodersmall logdecoder root, index, sessiondb, metadb
Concentratorconcentrator

concentrator root, metadb, sessiondb

Concentrator index index

Archiver

archiver

database

Volume Sizing

The volume sizes below are automatically created when using the NetWitness Platform storage tool, described in Configure Storage Using the REST API.

                                                                                                         

Volume

FilesystemMount PointSize
decodersmall decoroot /var/netwitness/decoder 10 GB
decodersmall index /var/netwitness/decoder/index 30 GB
decodersmall sessiondb /var/netwitness/decoder/sessiondb 600 GB
decodersmall metadb/var/netwitness/decoder/metadb100% of free space on
decodersmall volume
decoder packetdb/var/netwitness/decoder/packetdb100% of free space on
decoder volume
logdecodersmalldecoroot /var/netwitness/logdecoder10 GB
logdecodersmallindex/var/netwitness/logdecoder/index30 GB
logdecodersmallsessiondb /var/netwitness/logdecoder/sessiond 600 GB
logdecodersmallmetadb/var/netwitness/logdecoder/metadb100% of free space on logdecodersmall volume
logdecoder packetdb /var/netwitness/logdecoder/packetdb 100% of free space on
logdecoder volume
concentratorroot/var/netwitness/concentrator30 GB
concentrator sessiondb /var/netwitness/concentrator/sessiondb10% of free space on concentrator volume
concentratormetadb/var/netwitness/concentrator/metadb 100% of free space on concentrator volume
index index /var/netwitness/concentrator/index 100% of free space on
index volume
archiverdatabase/var/netwitness/archiver/database100% of free space on archiver volume

Performance Recommendations

RSA recommends that Packet and Log Decoders receive two LUNs or Block Devices, one for Packet data, the other for all other databases. This allows you to segregate the high-bandwidth Packet Database from the other databases so they do not compete for I/O bandwidth with other activity.

Concentrators require a separate SSD-based index volume for best performance. You must house this index volume on a different RAID group than the Concentrator Meta database volume, which you can stored on NL-SAS. Archivers can use a single large NL-SAS storage volume per appliance.

Input/Output Operations Per Second

The following table lists the IOPS requirements for the Decoder and Concentrator hosts.

                            
LogsLog Decoder Concentrator
10K EPS4008,000
20K EPS55010,300

25K EPS

1,200

10,800

 

                                      
PacketsNetwork DecoderConcentrator
1Gbps6006,050
2 Gbps9508,300

4 Gbps

1,650

12,800

6 Gbps2,40017,300

8 Gbps

3,200

21,800

General Description of How NetWitness Platform Hosts Store Data

For information about how NetWitness Platform hosts store data, see Appendix A. How NetWitness Platform Hosts Store Data.

Previous Topic:Storage Overview
You are here
Table of Contents > Storage Requirements

Attachments

    Outcomes