Difference between revisions of "Old Legacy Server Sizing"
(→Disk IO For Flow Writing To DB) |
|||
| Line 56: | Line 56: | ||
i.e. allow for a base of 20 IOPs, add an additional 1 IOP/s for every 500 flow/s and another 1 IOP/s for every 5 devices. | i.e. allow for a base of 20 IOPs, add an additional 1 IOP/s for every 500 flow/s and another 1 IOP/s for every 5 devices. | ||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
{| class="wikitable" border="1" | {| class="wikitable" border="1" | ||
| Line 96: | Line 79: | ||
| 102 | | 102 | ||
|} | |} | ||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
== Disk IO For Flow Reading From DB == | == Disk IO For Flow Reading From DB == | ||
Revision as of 10:17, 6 December 2018
Contents |
What Server Specification Do We Need?
Flows and Server Sizing
GigaFlow has been tested and certified to support up to 1,000 concurrent devices or up to 40,000 flows per second (flow/s) from less than 20 devices.
The flow rate changes with the number of connected devices as follows:
Flows/s Devices 50,000 10 40,000 20 20,000 40 10,000 80 5,000 160 2,500 300 1,250 600 1,000 1,000
Disk Throughput For Flow Writing To DB
Allow for at least 600 bytes per flow record per second for I/O throughput, i.e.
| Flow/s | Bytes/s (Sustained Write Performance) | MB/s (Sustained Write Performance) |
|---|---|---|
| 100 | 60,000 | 0.6 |
| 2,000 | 1,200 | 1.2 |
| 10,000 | 6,000,000 | 6.0 |
| 40,000 | 24,000,000 | 24.0 |
Disk IO For Flow Writing To DB
With f = flow/s d = number of devices I = Input/Output performance measurement (IOP), nominally sustained sequential writing.
I = 20 + (f / 500) + (d / 5)
i.e. allow for a base of 20 IOPs, add an additional 1 IOP/s for every 500 flow/s and another 1 IOP/s for every 5 devices.
| Flow/s | Number of Devices | IOPs |
|---|---|---|
| 1,000 | 1,000 | 222 |
| 5,000 | 1,000 | 230 |
| 10,000 | 100,000 | 60 |
| 40,000 | 10 | 102 |
Disk IO For Flow Reading From DB
Allow for 100 IOPs read to deliver a suitable reporting experience 100,000 rows of flow data take approx 1 second to report on at a 100MB/s read rate.
Disk Sizing
The server must support at least 300MB/s sustained for both read and write to support the peak device or flow count. Failing to do so will result in dropped flow details. For Linux, the recommendation would be to use EXT4 or XFS file systems and have the database on it's own raid partition. The addition of a hardware raid controller supporting Raid 10 or at least Raid 5 will also improve performance and provide hardware redundancy. The amount of storage required is directly related to the flow rate and what features are enabled.
| Data Type | Min Space Per Record |
|---|---|
| Forensics Flow | 250bytes |
| Event Record | 900Bytes |
e.g 500 flow/s of forensics = 450MB per hour = 11GB of disk space per day.
RAM Sizing
A base installation should have 4GB or RAM available for the OS and and additional 50MB per device to monitor. More ram will always improve performance e.g
| Number Of Devices | Min Ram |
|---|---|
| 10 | 4.5GB |
| 100 | 9GB |
| 500 | 29GB |
| 1000 | 54GB |
CPU sizing
As Anuview Flow is based on the Postgres database, overall performance is also dependent on CPU performance.
There is little gain going beyond 8 cores however more powerful CPUs would provide a better experience. Intel XeonX5680 3GHz or Core i7-3770S 3GHz would be recommended as a minimum.
