Difference between revisions of "Old Legacy Server Sizing"
(→Disk Throughput For Flow Writing To DB) |
(→Disk Sizing) |
||
| Line 85: | Line 85: | ||
== Disk Sizing == | == Disk Sizing == | ||
| − | The server must support at least | + | The server must support at least 300 MB/s sustained read and write to handle the peak device or flow count. Anything less than this will result in dropped flows. For Linux, we recommend EXT4 or XFS file systems as well a dedicated RAID partition for the database. Adding a hardware RAID controller that supports RAID 10, or at least RAID 5, will improve performance and provide hardware redundancy. The amount of storage required is directly related to the flow rate and features enabled. |
| − | For Linux, | + | |
| − | + | ||
| − | The amount of storage required is directly related to the flow rate and | + | |
{| class="wikitable" border="1" | {| class="wikitable" border="1" | ||
|- | |- | ||
! Data Type | ! Data Type | ||
| − | ! | + | ! Minimum Space per Record (Bytes) |
|- | |- | ||
| Forensics Flow | | Forensics Flow | ||
| − | | | + | | 250 |
|- | |- | ||
| Event Record | | Event Record | ||
| − | | | + | | 900 |
|} | |} | ||
| − | |||
| − | |||
| + | 500 flow/s of forensics == 450 MB per hour == 11 GB disk space per day. | ||
== RAM Sizing == | == RAM Sizing == | ||
Revision as of 10:19, 6 December 2018
Contents |
What Server Specification Do We Need?
Flows and Server Sizing
GigaFlow has been tested and certified to support up to 1,000 concurrent devices or up to 40,000 flows per second (flow/s) from less than 20 devices.
The flow rate changes with the number of connected devices as follows:
Flows/s Devices 50,000 10 40,000 20 20,000 40 10,000 80 5,000 160 2,500 300 1,250 600 1,000 1,000
Disk Throughput for Flow Writing to Database
Allow for at least 600 bytes per flow record per second for I/O throughput, i.e.
| Flow/s | Bytes/s (Sustained Write Performance) | MB/s (Sustained Write Performance) |
|---|---|---|
| 100 | 60,000 | 0.6 |
| 2,000 | 1,200 | 1.2 |
| 10,000 | 6,000,000 | 6.0 |
| 40,000 | 24,000,000 | 24.0 |
Disk I/O for Flow Writing To Database
With f = flow/s d = number of devices I = Input/Output performance measurement (IOP), nominally sustained sequential writing.
I = 20 + (f / 500) + (d / 5)
i.e. allow for a base of 20 IOPs, add an additional 1 IOP/s for every 500 flow/s and another 1 IOP/s for every 5 devices.
| Flow/s | Number of Devices | IOPs |
|---|---|---|
| 1,000 | 1,000 | 222 |
| 5,000 | 1,000 | 230 |
| 10,000 | 100,000 | 60 |
| 40,000 | 10 | 102 |
Disk I/O for Flow Reading from Database
Allow for at least 100 IOPs read. It takes approximately one second to report on 100,000 rows at 100 MB/s.
Disk Sizing
The server must support at least 300 MB/s sustained read and write to handle the peak device or flow count. Anything less than this will result in dropped flows. For Linux, we recommend EXT4 or XFS file systems as well a dedicated RAID partition for the database. Adding a hardware RAID controller that supports RAID 10, or at least RAID 5, will improve performance and provide hardware redundancy. The amount of storage required is directly related to the flow rate and features enabled.
| Data Type | Minimum Space per Record (Bytes) |
|---|---|
| Forensics Flow | 250 |
| Event Record | 900 |
500 flow/s of forensics == 450 MB per hour == 11 GB disk space per day.
RAM Sizing
A base installation should have 4GB or RAM available for the OS and and additional 50MB per device to monitor. More ram will always improve performance e.g
| Number Of Devices | Min Ram |
|---|---|
| 10 | 4.5GB |
| 100 | 9GB |
| 500 | 29GB |
| 1000 | 54GB |
CPU sizing
As Anuview Flow is based on the Postgres database, overall performance is also dependent on CPU performance.
There is little gain going beyond 8 cores however more powerful CPUs would provide a better experience. Intel XeonX5680 3GHz or Core i7-3770S 3GHz would be recommended as a minimum.
