Virtual Host Setup: Task 2. Review Optimal Datastore Space Configuration

Document created by RSA Information Design and Development on Oct 18, 2017•Last modified by RSA Information Design and Development on Jan 29, 2018
Version 2Show Document
  • Comment • 0
  • View in full screen mode
  

You need to review the datastore space configuration options for the different hosts to get the optimal performance from your virtual Security Analytics deployment. Datastores are required for virtual host configuration, and the correct size is dependent on the host.

Note: (1.) Refer to the "Optimization Techniques" topic in the RSA Security Analytics Core Database Tuning Guide for recommendations on how to optimize datastore space. (2.) Contact Customer Care for assistance in configuring your virtual drives and using the Sizing & Scoping Calculator.

Virtual Drive Space Ratios

The following table provides optimal configurations for packet and log hosts. Additional partitioning and sizing examples for both packet capture and log ingest environments are provided at the end of this topic.

                                 
Decoder
Persistent 
Datastores 		Cache Datastore
PacketDB SessionDB MetaDB Index
100% as calculated by Sizing & Scoping Calculator6 GB per 100Mb/s of traffic sustained provides 4 hours cache60 GB per 100Mb/s of traffic sustained provides 4 hours cache3 GB per 100Mb/s of traffic sustained provides 4 hours cache

 

                             
Concentrator
Persistent 
Datastores 		Cache Datastores
MetaDB SessionDB
Index 		Index
Calculated as 10% of the PacketDB 
required for a 1:1 retention ratio		30 GB per 1TB of PacketDB for standard multi protocol network deployments as seen at typical internet gateways5% of the calculated MetaDB on the Concentrator. Preferred High Speed Spindles or SSD for fast access

 

                                
Log Decoder
Persistent 
Datastores 		Cache Datastores
PacketDB SessionDB MetaDB Index
100% as calculated by Sizing & Scoping Calculator1 GB per 1000 EPS of traffic sustained provides 8 hours cache20 GB per 1000 EPS of traffic sustained provides 8 hours cache0.5 GB per 1000 EPS of traffic sustained provides 4 hours cache

 

                            
Log Concentrator
Persistent 
Datastores 		Cache Datastores
MetaDB SessionDB
Index 		Index
Calculated as 100% of the PacketDB 
required for a 1:1 retention ratio		3 GB per 1000 EPS of sustained traffic per day of retention5% of the calculated MetaDB on the Concentrator. Preferred High Speed Spindles or SSD for fast access
You are here
Table of Contents > Install SA Virtual Host in Virtual Environment > Step 3. Configure Datbases to Accomodate Security Analytics > Task 2. Review Optimal Datastore Space Configuration

Attachments

    Outcomes