09-30-2010 06:40 AM
Hello,
At the moment I am prepairing the documentation for MARS-25 implementation. I have to consider the total amount of compressed data which will be stored in arcive data base. The plan is to have EPS around 300 (mainly syslog messages). I was looking for some figures about the daily amount of data in folders AL, CF, ES, IN, RR and ST.
Would someone please share their knowlege about the proportions of those folder sizes or the acctual input of data in archive data base per day? Approximated evaluations would be more than enough for me at the moment.
Best regards,
Gintas
09-30-2010 04:55 PM
Hello,
Here is a sample calculation from our doc guide
Each MARS Appliance seamlessly archives data using an expiration date that you specify. When the
MARS internal storage reaches capacity, it automatically purges the data in the oldest partition of the
local database, roughly 10% of the stored event and session data. The data in the NFS file share has a
life span specified in days. Therefore, to keep a year’s worth of data, you would specify 365 days as the
value for the Remote Storage Capacity (in Days) field. All data older than 365 days is purged from the
archive file.
When planning for space requirements, use the following guidance: Estimate 6 GB of storage space for
one year’s worth of data, received at a sustained 10 events/second. This estimate assumes an average of
200 Bytes/event and a compression factor of 10, both realistic mean values. In addition to capacity
planning, plan the placement of your NFS server to ensure a reliable network connection that can
transmit 10 MB/second exists between the NFS server and the MARS Appliance. You should consider
using the eth1 interface to avoid high-traffic networks that might introduce latency and to ensure that the
backup operation is not competing with other operations in the MARS Appliance. Also, define a default
route to the NFS server on the MARS Appliance and that you verify any intermediate routers and
firewalls allow for multi-hour NFS connections to prevent session timeouts during the backup operation.
Thanks,
--Sunil
10-05-2010 04:10 AM
Thank you Sunil,
Sorry, I still can't get it. Is the additional space for recovery and config files, session and incident data included in those figures? Because here is what I get:
10 EPS x [seconds per year] x 200 B/event x 0.1 (compression 10:1)= 630 MB -amount of space for raw events.
If it is assumend, than you need 6 GB for one year data stored in data base, does that meen you need 6000-630=5370 MB space for non-raw events data?
Thanks again,
GP
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide