Old Legacy Server Sizing
What Server Specification Do We Need?
Flows and Server Sizing
GigaFlow has been tested and certified to support up to 1,000 concurrent devices or up to 40,000 flows per second (flow/s) from less than 20 devices.
The flow rate changes with the number of connected devices as follows:
Flows/s Devices 50,000 10 40,000 20 20,000 40 10,000 80 5,000 160 2,500 300 1,250 600 1,000 1,000
Disk Throughput For Flow Writing To DB
Allow for at least 600 bytes per flow record per second for I/O throughput, i.e.
Flow/s Bytes/s (Sustained Write Performance) MB/s (Sustained Write Performance) 100 60,000 0.6 2,000 1,200 1.2 10,000 6,000,000 6.0 40,000 24,000,000 24.0
Flow/s | Bytes/s (Sustained Write Performance) | MB/s (Sustained Write Performance) |
---|---|---|
100 | 60,000 | 0.6 |
2,000 | 1,200 | 1.2 |
10,000 | 6,000,000 | 6.0 |
40,000 | 24,000,000 | 24.0 |
Disk IO For Flow Writing To DB
The formula 20+(flowPerSecond/500)+(devices/5)=IOPs Write sustained
1) Allow for a base of 20 IOPs.
2) Add an additional 1 IOP/s for every 500 flows/s.
3) Add an additional 1 IOP/s for every 5 devices
1k flows/s, 1000 devices = (20 +(1000/500)+(1000/5)) = 20+2+200= 222 IOPs 5k flows/s, 1000 devices = (20 +(5000/500)+(1000/5)) = 20+10+200= 230 IOPs 10k flows/s, 100 devices = (20 +(10000/500)+(100/5)) = 20+20+20= 60 IOPs 40k flows/s, 10 devices = (20 +(40000/500)+(10/5)) = 20+80+2= 102 IOPs
Disk IO For Flow Reading From DB Allow for 100 IOPs read to deliver a suitable reporting experience 100,000 rows of flow data take approx 1 second to report on at a 100MB/s read rate.
Disk Sizing
The server must support at least 300MB/s sustained for both read and write to support the peak device or flow count. Failing to do so will result in dropped flow details.
For Linux, the recommendation would be to use EXT4 or XFS file systems and have the database on it's own raid partition.
The addition of a hardware raid controller supporting Raid 10 or at least Raid 5 will also improve performance and provide hardware redundancy.
The amount of storage required is directly related to the flow rate and what features are enabled.
Data Type | Min Space Per Record |
---|---|
Forensics Flow | 250bytes |
Event Record | 900Bytes |
e.g 500 flow/s of forensics = 450MB per hour = 11GB of disk space per day.
RAM Sizing
A base installation should have 4GB or RAM available for the OS and and additional 50MB per device to monitor. More ram will always improve performance
e.g
Number Of Devices | Min Ram |
---|---|
10 | 4.5GB |
100 | 9GB |
500 | 29GB |
1000 | 54GB |
CPU sizing As Anuview Flow is based on the Postgres database, overall performance is also dependent on CPU performance.
There is little gain going beyond 8 cores however more powerful CPUs would provide a better experience. Intel XeonX5680 3GHz or Core i7-3770S 3GHz would be recommended as a minimum.