Did i can trust to 1/10 compression for planning capacity for ArcSight ESM?
I am planning the capacity of Storage allocation to ArcSight ESM. in this case i have a limitation for EPS and LogVolume/Day in ESM license.
as you know there are a huge feature in smart connector imply to 1/10 compression.
did i can trust to the compression feature for capacity planning and storage design?
I can also confirm these ratios, we do 10+ TB storage per installation, and we see anything from 1:7 to 1:10 normally, again it really depends on the data that you feed it.
We always perform tests first, which i would really recommend. Just feed it a few GB of data, and see how much storage it takes in the end.
Just remember that ESM is not supposed to be used for long term retention of data, i would not recommend going above the 30 days retention period, that's what you have the Logger for 🙂
One important note, if you do higher volumes, is that 14TB is the max limit of storage like Logger, so if you are doing more than that you either need to export old data into archives, or use a Logger pool.
All topics and replies made is based on my personal opinion, viewpoint and experience, it does not represent the viewpoints of MicroFocus.
All replies is based on best effort, and can not be taken as official support replies.