ESM minimum install 7.6

I need a minimum installation of ESM 7.6 purely for development purposes on a hyper-v centos 7.9 vm running on a laptop. The System requirements for the minimum install are

Processors 8 cores (16 preferred) 32 cores 40 cores
Memory 48 GB RAM (64 preferred) 192 GB RAM 512 GB RAM
Hard Disk Six 600 GB disks (1.5 TB)

My laptop specs aren't up to these requirements, and of course trying to install with less just fails.

Is there anyway to get a "more minimal" install of ESM, given that EPS is going to be 0 on this installation? I am using  ArcSightESMSuite-7.6.0.2523.0.tar: is there another installer I could use, one perhaps that does not include support for distributed mode?

  • I think CPUs are not as important, but RAM is. Disk Size... set it to somthing like "grow during use"

    The installation script, at least in older versions, checks if the ESM started sucessfully, this takes more time if you have less RAM - and will fail.

  • Suggested Answer

    I pulled this from the 7.6 Installation Guide

    Processors 8 cores (16 preferred) 32 cores 40 cores
    Memory 48 GB RAM (64 preferred) 192 GB RAM 512 GB RAM
    Hard Disk Six 600 GB disks (1.5 TB)
    (RAID 10)
    10,000 RPM
    20 1 TB disks (10 TB)
    (RAID 10)
    15,000 RPM
    12 TB
    (RAID 10)
    Solid state

  • Thanks, Dale. I ended up being able to get an ESM running with 120GB disk, 16GB RAM, and 4 processors. It's not for production!

  • Hello David, 

    the way that i preparing my VM lab is the following: 

    4 x CPUs

    16 GB RAM ( 32 recommended )

    Disks :

     1 x 25 GB : necessary to deploy the OS /  CentOS/Rocky Linux or RHEL  - minimum install with the following required rpm: 

    libnsl
    ncurses-compat-libs
    zip
    unzip
    libaio
    libaio-devel
    numactl

    rng-tools ( starting with ESM 7.4 )

     1 x 60 GB : for /opt where the arcsight folder 

    and that should be enough for an very small LAB to see the product be familiar with it but do not expect to persist more then few events.

    For better results use the recommended env. from the install document. Those recommendation's are there for a reason.

    I hope that will help you and later others for preparing an small lab .

    Best Regards, 

    Daniel