Highlighted
Honored Contributor.
Honored Contributor.
735 views

Did i can trust to 1/10 compression for planning capacity for ArcSight ESM?

Hi All

I am planning the capacity of Storage allocation to ArcSight ESM. in this case i have a limitation for EPS and LogVolume/Day in ESM license. 

as you know there are a huge feature in smart connector imply to 1/10 compression.

did i can trust to the compression feature for capacity planning and storage design?

BR

Amir

Labels (1)
0 Likes
4 Replies
Highlighted
Honored Contributor.
Honored Contributor.

Hi,

It depends on the content of the logs. In normal practice 1:7 compression ratio is used.

 

Regards,
Kaleem Ullah
0 Likes
Highlighted
Honored Contributor.
Honored Contributor.

hi @BTO

i thinks your quick replied response is not clearly and countable. 

I need a practical answer.

did you have any experience about this challenge?

BR

Amir

 

0 Likes
Highlighted
Honored Contributor.
Honored Contributor.

I have been part of partner deployment team since 3 years. Work on one project with hpe ps team as well. All of them calculate it to 1:7 ratio.
Regards,
Kaleem Ullah
0 Likes
Highlighted
Acclaimed Contributor.
Acclaimed Contributor.

I can also confirm these ratios, we do 10+ TB storage per installation, and we see anything from 1:7 to 1:10 normally, again it really depends on the data that you feed it.

We always perform tests first, which i would really recommend. Just feed it a few GB of data, and see how much storage it takes in the end.

Just remember that ESM is not supposed to be used for long term retention of data, i would not recommend going above the 30 days retention period, that's what you have the Logger for 🙂

One important note, if you do higher volumes, is that 14TB is the max limit of storage like Logger, so if you are doing more than that you either need to export old data into archives, or use a Logger pool.

-----------------------------------------------------------------------------------------
All topics and replies made is based on my personal opinion, viewpoint and experience, it does not represent the viewpoints of MicroFocus.
All replies is based on best effort, and can not be taken as official support replies.
//Marius
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.