Old Legacy Server Sizing
Anuview Flow has been tested and certified to support up to 1000 concurrent devices or up to 40k flows/s from < 20 devices.
Below we can see as more devices are added to the system, the supported flow rate decreases in proportion.
Flows/s Devices 50000 10 40000 20 20000 40 10000 80 5000 160 2500 300 1250 600 1000 1000
Disk Throughput For Flow Writing To DB Allow for at least 600 bytes per flow record per seconds for IO throughput e.g.
100 flows/s = 1000*600 = 60000=0.6MB/sec of sustained write performance required. 2000 flows/s = 2000*600 = 1200000 = 1.2MB/s of sustained write performance required. 10000 flows/s = 10000*600 = 6000000 = 6MB/s of sustained write performance required. 40000 flows/s = 40000*600 = 24000000 = 24MB/s of sustained write performance required.
Disk IO For Flow Writing To DB The formula 20+(flowPerSecond/500)+(devices/5)=IOPs Write sustained
1) Allow for a base of 20 IOPs.
2) Add an additional 1 IOP/s for every 500 flows/s.
3) Add an additional 1 IOP/s for every 5 devices
1k flows/s, 1000 devices = (20 +(1000/500)+(1000/5)) = 20+2+200= 222 IOPs 5k flows/s, 1000 devices = (20 +(5000/500)+(1000/5)) = 20+10+200= 230 IOPs 10k flows/s, 100 devices = (20 +(10000/500)+(100/5)) = 20+20+20= 60 IOPs 40k flows/s, 10 devices = (20 +(40000/500)+(10/5)) = 20+80+2= 102 IOPs
Disk IO For Flow Reading From DB Allow for 100 IOPs read to deliver a suitable reporting experience 100,000 rows of flow data take approx 1 second to report on at a 100MB/s read rate.
Disk Sizing The server must support at least 300MB/s sustained for both read and write to support the peak device or flow count. Failing to do so will result in dropped flow details. For Linux, the recommendation would be to use EXT4 or XFS file systems and have the database on it's own raid partition. The addition of a hardware raid controller supporting Raid 10 or at least Raid 5 will also improve performance and provide hardware redundancy. The amount of storage required is directly related to the flow rate and what features are enabled.
|Data Type||Min Space Per Record|
e.g 500 flow/s of forensics = 450MB per hour = 11GB of disk space per day.
RAM Sizing A base installation should have 4GB or RAM available for the OS and and additional 50MB per device to monitor. More ram will always improve performance e.g
|Number Of Devices||Min Ram|
CPU sizing As Anuview Flow is based on the Postgres database, overall performance is also dependent on CPU performance.
There is little gain going beyond 8 cores however more powerful CPUs would provide a better experience. Intel XeonX5680 3GHz or Core i7-3770S 3GHz would be recommended as a minimum.