Security Compliance

How reservations work on SEM

This page takes new customers through an explanation of how reservations work on SEM.

First published date

11/29/2018 10:25 PM

Last published date

11/29/2018 10:25 PM

Overview

This article provides a simplified explanation of how reservations work on Security Event Manager (formerly Log & Event Manager). For a more technical explanation on reservations, please review the following article: The Reason why SEM Needs Memory and CPU Resource Reservations.

Product section

Security Event Manager

Resolution

In this article is a breakdown of what the SEM must have set up by default in order to work. 


Resources necessary for interface functionality and recording event data
The level of auditing set in your network environment can be referred to as the flow of event data. That flow of event data is being directed at the SEM appliance from all of the nodes connecting to it. As you add machines to SEM from your environment for the purpose of capturing their logs, and as you make adjustments to the Audit Policies and Best Practices for SEM in your environment, you can experience performance issues on the SEM appliance if the load is too high for your CPU and Memory Reservations. For more information, see SEM performance check.


SEM  CPU and memory reservations
NOTE: The reservation values in the documents listed here are estimates. 
Though a system may work given default reservations, there are many other factors that could come into play based on the hypervisor's hardware and the network environment that the SEM has been set up in. vSphere or Hyper-V are the only two supported hypervisors at this time. Any estimation on this page for sizing or for configuring settings that are being given to the SEM virtual machine will not constitute a baseline, but an estimation based on our default reservations mentioned in this article.  

The hardware in your particular environment can be different than in our test scenarios, and it is not possible for us to know whether or not a system will absolutely work without being able to test that particular set of hardware devices. Please take this into consideration as you review the following information.


Hardware disk speeds (IOPS)
Setting up the SEM virtual machine in an environment with insufficient IOPS (under 100 MB/s) will cause SEM to have issues operating and dealing with incoming event data, as well as recording that data to the database. This can also affect rules, queries (nDepth searches and reports), or web console interface functionality. 


Some arbitrary IOPS numbers to understand 
IOPS in relation to event numbers being sent to SEM. As you review these numbers, it's important to note they can fluctuate higher or lower based on the hardware and software involved in running the SEM appliance on the host machine where the SEM virtual machine has been deployed:

< 20 MB / sec: is an unacceptable IOPS level, and the virtual machine must have faster storage access to work

30 MB/sec to 100MB/sec: can probably handle up to around 15 million events/day, but speed is still marginal

100 MB/sec to 200MB/sec: can probably handle up to around 30 million events/day

200 MB/sec to 300MB/sec: can probably handle up to around 60 million events/day

300 MB/sec to 400MB/sec: can probably handle up to around 120 million events/day

> 400MB/sec: can probably handle up to around 200+ million events/day


Reference articles for IOPS from VMware

Keeping SEM stable as event load increases

Stable environments change over time and resource options increase based on the incoming event load. It is important to consider increases in logging as you make decisions on where to deploy or migrate SEM. 

Feel free to contact our technical support for further details or to help with a performance assessment on a currently deployed SEM Appliance.



Disclaimer: Please note, any content posted herein is provided as a suggestion or recommendation to you for your internal use. This is not part of the SolarWinds software or documentation that you purchased from SolarWinds, and the information set forth herein may come from third parties. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment.  You elect to use third party content at your own risk, and you will be solely responsible for the incorporation of the same, if any.