ArcSight || VM ESM System requirement?

Hi All,

 

We are going to setup a ESM express at AV environment

But we find that there are only three level of system requirement

Which EPS is not mentioned

 

May I know if there are any guide for sizing?

If Minimum is not enough, is there any in between guide? Mid-Range seem too expressive

Any suggestion if 350 EPS is needed?

System requirement.PNGRe-grads

Tony Lo

Parents
  • Hi Tony,

     

    referring back to the same document where you got the requirements I will like to highlight the following:

    Caution: The "Minimum" values apply to systems running base system content at low EPS (typical
    in lab environments). It should not be used for systems running high number of customer-created
    resources, or for systems that need to handle high event rates. Use the "Mid Range" or "High
    Performance" specifications for production environments that handle a sizable EPS load with
    additional content and user activity.

     

    My advice is to start to think any ESM system for production thinking from "Mid-Range".

    Before deciding the way that you will choose the hardware also think about:

    - what will be the retention period need it,

    - the number of users that are connecting to this ESM.

    - how much custom content are you develop on feature server.

     

    As you said you will probably start with 350 EPS but I have always seen the tendency to double the initial value.

     

    Best Regards,

     

    Daniel

Reply
  • Hi Tony,

     

    referring back to the same document where you got the requirements I will like to highlight the following:

    Caution: The "Minimum" values apply to systems running base system content at low EPS (typical
    in lab environments). It should not be used for systems running high number of customer-created
    resources, or for systems that need to handle high event rates. Use the "Mid Range" or "High
    Performance" specifications for production environments that handle a sizable EPS load with
    additional content and user activity.

     

    My advice is to start to think any ESM system for production thinking from "Mid-Range".

    Before deciding the way that you will choose the hardware also think about:

    - what will be the retention period need it,

    - the number of users that are connecting to this ESM.

    - how much custom content are you develop on feature server.

     

    As you said you will probably start with 350 EPS but I have always seen the tendency to double the initial value.

     

    Best Regards,

     

    Daniel

Children