Planning the capacity of database storage

[gintautas.pusinskas]

Hello,

At the moment I am prepairing the documentation for MARS-25 implementation. I have to consider the total amount of compressed data which will be stored in arcive data base. The plan is to have EPS around 300 (mainly syslog messages). I was looking for some figures about the daily amount of data in folders AL, CF, ES, IN, RR and ST.

Would someone please share their knowlege about the proportions of those folder sizes or the acctual input of data in archive data base per day? Approximated evaluations would be more than enough for me at the moment.

Best regards,

Gintas

[CY1234]

Hello,

Here is a sample calculation from our doc guide

Each MARS Appliance seamlessly archives data using an expiration date that you specify. When the

MARS internal storage reaches capacity, it automatically purges the data in the oldest partition of the

local database, roughly 10% of the stored event and session data. The data in the NFS file share has a

life span specified in days. Therefore, to keep a year’s worth of data, you would specify 365 days as the

value for the Remote Storage Capacity (in Days) field. All data older than 365 days is purged from the

archive file.

When planning for space requirements, use the following guidance: Estimate 6 GB of storage space for

one year’s worth of data, received at a sustained 10 events/second. This estimate assumes an average of

200 Bytes/event and a compression factor of 10, both realistic mean values. In addition to capacity

planning, plan the placement of your NFS server to ensure a reliable network connection that can

transmit 10 MB/second exists between the NFS server and the MARS Appliance. You should consider

using the eth1 interface to avoid high-traffic networks that might introduce latency and to ensure that the

backup operation is not competing with other operations in the MARS Appliance. Also, define a default

route to the NFS server on the MARS Appliance and that you verify any intermediate routers and

firewalls allow for multi-hour NFS connections to prevent session timeouts during the backup operation.

Thanks,

--Sunil

[gintautas.pusinskas]

Thank you Sunil,

Sorry, I still can't get it. Is the additional space for recovery and config files, session and incident data included in those figures? Because here is what I get:

10 EPS x [seconds per year] x 200 B/event x 0.1 (compression 10:1)= 630 MB -amount of space for raw events.

If it is assumend, than you need 6 GB for one year data stored in data base, does that meen you need 6000-630=5370 MB space for non-raw events data?

Thanks again,

GP