Run Storage Benchmark Utility

Document created by RSA Information Design and Development on Oct 17, 2017
Version 1Show Document
  • View in full screen mode
 

You can use third-party attached storage with an RSA NetWitness Suite host. The nwBenchmark utility helps you determine if the third-party storage attached and configured to an RSA NetWitness Suite host is compliant. This document tells you how to run this utility and troubleshoot non-compliant storage issues.

Note: Note: Read the RSA NetWitness Suite Third-Party Additional Storage Configuration Guide for high-level requirements for third-party storage and instructions on how to configure this hardware in NetWitness Suite.

The NetWitness Suite Benchmark Utility (nwBenchmark.py) provides you with the read and write throughput metrics so that you can access your additional storage deployment performance.

nwBenchmark Utility Command Options

                         
Command OptionsResults (default values are in brackets"[]")
-h, --help Show this help message and exit.
-s SRVC, --service=SRVCAppliance service type (decoder, logdecoder, concentrator, archiver) [decoder].
-d DB, --db=DB Database to benchmark (packetdb[0-9]*, metadb[0-9]*, index[0-9]*, database[0-9]*) [packetdb].
-p PATH, --path=PATH Path to the mounted directory of the storage to be tested.

Prerequisites

Before you run the nwBenchmark utility, you must have the:

  • Rsa-nw-tools RPM installed on the host.
  • Attached storage in place.

Running the Utility

To run the nwBenchmark utility.

  1. Retrieve the Rsa-nw-tools-11.0.0.0.XX-5.el7.noarch.rpm from the NetWitness Server Update Repository.
    This rpm contains the nwBenchmark.py utility.

Note: If NetWitness Suite is not connected to the Internet, you can download the NW-v11.0.0.0-UpgradePack.zip, which contains all the Rsa-nw-tools-11.0.0.0.XX-5.el7.noarch.rpm, from Download Central (https://download.rsasecurity.com/ ) to a local directory.

  1. Run the utility.
    nwBenchmark.py options
    The utility displays verification of the platform based on the services the utility detects. The utility determines if the host detected system is supported or unsupported.

    For example, if the utility detects:
    • Log Decoder services (supported), System detected as a Log Decoder is displayed and the utility continues.
    • Log Decoder, Concentrator, and Event Stream Analysis (ESA) services (un supported), Unsupported configuration detected on the system is displayed and the utility fails.

The results are displayed.

Example 1. Concentrator Results - In Compliance with NetWitness Suite

 

Make sure the storage device you are testing is attached to the host running the Concentrator and run the following command on that host.

[root@PE-D4S-103 ~]# /opt/rsa/saTools/nwBenchmark.py

Results

The appliance disk geometry meets the expected topology for the decoder service.

Using 1 minutes 0 second run time for all IO tests.

Started IO test preparation for the metadb and packetdb at 13:05:31

Starting following IO test(s) on metadb and packetdb at 13:08:21

Directory: /var/netwitness/decoder/metadb
Test description: Random Read IO test
Block Size: 128K

Directory: /var/netwitness/decoder/packetdb
Test description: Sequential Write IO test
Block Size: 1024M

Total run time: 4 minutes 15 seconds

The appliance meets the indicated percentages of the
following requirements for the decoder service:

Requirement________ Expected Discovered % Compliant
------------------- -------- ---------- -----------

Read IOPs metadb _______ 160 _______ 155 _____96.87%

Write BW packetdb___1400 MBs__ 1634 MBs_____116.71%

How to Interpret Results

The results in this example indicate that you should have no performance issues using this storage device for the Concentrator.

Action Required

none.

Example 2. Packet Decoder Results - Not In Compliance with NetWitness Suite

Make sure the storage device you are testing is attached to the host running the Decoder and run the following command on that host.

[root@PE-D4S-103 saTools]# ./nwBenchmark.py

Results

The appliance disk geometry meets the expected topology for the decoder service.

Using 1 minutes 0 second run time for all IO tests.

Started IO test preparation for the metadb and packetdb at 13:05:31

Starting following IO test(s) on metadb and packetdb at 13:08:21

Directory: /var/netwitness/decoder/metadb
Test description: Random Read IO test
Block Size: 128K

Directory: /var/netwitness/decoder/packetdb
Test description: Sequential Write IO test
Block Size: 1024M

Total run time: 4 minutes 15 seconds

The appliance meets the indicated percentages of the
following requirements for the decoder service:

Requirement________Expected__Discovered % Compliant
------------------ --------- ---------- -----------
Read IOPs metadb_________160________150______93.75%
Write BW packetdb_____1400 MBs_____ 1634 MBs________116.71%

Based on the above results, this system does not meet the minimum requirements for a decoder.

It is possible that performance of this device may be impacted. Please refer to the "./nwBenchmark.log" file for the IO full test results.

How to Interpret Results

The benchmark utility uses a high-speed (10G) Decoder to measure the performance of the storage. The results in this example indicate that storage device performs slightly under the optimum performance expected for a high-speed Decoder.

This means that for a:

  • High-speed Decoder, you may or may not run into performance issues under high volume.
  • Standard-speed (2G) Decoder, you should have no performance issues.

Action Required

For a high-speed Decoder, you may want a stronger performing storage device if you want optimum performance under extreme volume conditions.

Example 3. Concentrator Results - Cannot Find Mount Points

Make sure the storage device you are testing is attached to the host running the Concentrator and run the following command on that host.

[root@PE-D4S-103 saTools]# ./nwBenchmark.py

Results

You have not indicated a path to the mounted storage and the appliance does not have the recommended mounted disk topology for the concentrator service. If the storage to be tested is mounted you must indicate the path to the directory of the mounted storage with the --path option.
The following expected mounts are missing:

/var/netwitness/concentrator/index
/var/netwitness/concentrator/metadb

How to Interpret Results

The utility cannot test this storage device because it was not supplied with the path of the index and the metadb partitions on the device.

Action Required

You need to specify the path of the index and the metadb partitions on the storage device. For example, submit the following command string on the host running the service (in this example, the host running the Concentrator service).

[root@PE-D4S-103 saTools]# ./nwBenchmark.py -p /var/netwitness/concentrator/ -s concentrator -d metadb

Results After Corrective Action

After specifying the correct path, you would receive results similar to the following results for the metadb partiton.

The appliance disk geometry meets the expected topology for the decoder service.
Using 1 minutes 0 second run time for all IO tests.
Started IO test preparation for the metadb at 13:50:21
Starting following IO test(s) on metadb at 13:51:07
Directory: /mnt
Test description: Random Read IO test
Block Size: 128K
Total run time: 1 minutes 47 seconds
The appliance meets the indicated percentages of the
following requirements for the concentrator service:

Requirement______Expected__Discovered % Compliant
---------------- --------- ---------- -----------

Read IOPs metadb_______300________323_____107.67%

Example 4. Log Decoder Results - In Compliance with NetWitness Suite

[root@PED4S101 saTools]# ./nwBenchmark.py
The appliance disk geometry meets the expected topology for the logdecoder service.
Using 1 minutes 0 second run time for all IO tests.
Started IO test preparation for the packetdb and metadb at 14:05:43
Starting following IO test(s) on packetdb and metadb at 14:07:28
Directory: /var/netwitness/logdecoder/packetdb
Test description: Random Read IO test
Block Size: 128K
Directory: /var/netwitness/logdecoder/metadb
Test description: Random Read IO test
Block Size: 128K
Total run time: 2 minutes 46 seconds
The appliance meets the indicated percentages of the
following requirements for the logdecoder service:

Requirement______Expected__Discovered % Compliant
---------------- --------- ---------- -----------
Read IOPs packetdb_____330________337_____102.12%

Read IOPs metadb_______330________327_____ 99.09%

How to Interpret Results

The results in this example indicate that you should have no performance issues using this storage device for the Log Decoder.

Action Required

none.

Example 5. Archiver Results - In Compliance with NetWitness Suite

[root@PE-D4S-101 saTools]# ./nwBenchmark.py
The appliance disk geometry meets the expected topology for the archiver service.
Using 1 minutes 0 second run time for all IO tests.
Started IO test preparation for the database0 at 14:14:10
Starting following IO test(s) on database0 at 14:14:38
Directory: /var/netwitness/archiver/database0
Test description: Random Read IO test
Block Size: 128K
Total run time: 1 minutes 28 seconds
The appliance meets the indicated percentages of the
following requirements for the archiver service:
Requirement___________Expected__ Discovered__ % Compliant
-------------------__ --------___----------____----------
Read IOPs database0_______ 360_________ 388______ 107.78%

How to Interpret Results

The results in this example indicate that you should have no performance issues using this storage device for the Archiver.

Action Required

none.

You are here
Table of Contents > Run Storage Benchmark Utility

Attachments

    Outcomes