Quantcast
Channel: THWACK: Message List - Security Event Manager (SEM) - Formerly Log & Event Manager
Viewing all articles
Browse latest Browse all 5385

Re: Requirements are vague!

$
0
0
  1. Cool, no worries then.  Best practice is to make sure that your Reports Console and LEM versions match.
  2. I left this vague depending on what your processes are.  Since we're on Thwack, Patch Manager was the first thing that came to mind, but if you have SCCM or another tool that can pull the inventory you can check for that.  Additionally you could check under Manage -> Nodes to check for the agents there and any that don't show up or aren't connected you're probably going to have to touch in any case.
  3. These numbers will affect the hardware requirements of the LEM, but not Reports.  No matter what, you're not going to be able to get more than 2 GB of report data out of the Reports Console right now.  15 million events per day and below you should be fine with 2 cores and 8 GB of RAM on the LEM itself.  15-30 million events per day you may want to set 4 cores and 16 GB of RAM (this is again on the Manager only, not the Reports machine).  These numbers you can get from the Sizing Guide that you have already for the Small/Medium/Large deployments.  As for the Reports machine you only really want the additional resources because you will be having multiple users on the machine.
  4. I figured I would pipe in since I'm here, but to me this is more a factor of the number of users.  If you have 4 analysts then 32 GB of RAM should be more than enough, I would say maybe 16 GB on the outside if all they are running is reports.  If you have 20 then it might be on the low end if they're using the machine all at the same time.

Viewing all articles
Browse latest Browse all 5385

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>