ESM Distributed Specs

Hi Experts,

Have a nice time!

Kindly, the below screenshot shows the ESM Node Specs for each node:

I am wondering why all node should have 8 TB Storage as the CORRE-Engine Storage(Retain events ) only hosted on the persistor?

Ali Maher 

  • Hello Ali, 

    is allocating an 8TB disk for the nodes represent a concern for you?

    Best Regards, 

    Daniel

  • Hi Ionut,

    Honestly,Yes so need to know the exact size should i allocate and for what purpose it usage?

    4 Non-Persistor Node * 8TB for Non-allocated Event Storage is a concern for our customers also?

    Ali Maher 

  • Hello Ali, 

    is true that sometimes resources are questionable when comes to the size correctly the environment.

    I had conversations with people involved in customer deployments and indeed those recommendations must be reviewed to provide a better understanding of space allocated to "nodes". 

    From my lab "distribute" environment ( 1 x persistor and 3x nodes) which has been upgraded from ESM 7.6 to 7.6.4, for example, the /opt/arcsight ( 100 GB) space allocated to them did not grow significantly. I am just using 20% of it but again this is a DEMO / LAB environment.

    Keep in mind to allocate separate disk/partition to mbus data like " /opt/mbus_data" and that size can vary on EPS as well.

    Anyway, try to inspire from the recommendations of hardware requirements for installing ESM 7.7 on AWS & Azure for Distribute environment.

    Best Regards, 

    Daniel

  • Thanks!

    You have mentioned an interesting point here "Keep in mind to allocate separate disk/partition to mbus data like " /opt/mbus_data" and that size can vary on EPS as well"

    I am a new in ESM distributed so could you please provide us with the recommended disk paritioning for the 8 TB Disk storage while each node will have different services.

    In case of 1x persistor Node and 4x Non-Persisitor Nodes with the following services setup:

    The nodes have the following software requirements: l

    Node 1:

    One persistor 

    One distributed cache   

    One information repository 

    Node 2:

    One correlator 

    One aggregator 

    One distributed cache 

    One message bus control 

    One message bus data 

    Node 3:

    One correlator 

    One aggregator 

    One distributed cache 

    One message bus control 

    One message bus data 

    One information repository

    Node 4: 

     One correlator 

    One aggregator 

    One distributed cache

    One message bus control 

    One message bus data 

    One information repository

    Node 5: 

    One distributed cache 

    One message bus data 

    One correlator 

    One aggregator

    I am waiting for your feedback ASAP!

    Ali Maher