Security Compliance

SEM RAM and CPU Recommendations

This article provides brief information on SEM RAM and CPU requirements.

First published date

10/10/2018 2:42 PM

Last published date

11/13/2025 5:47 PM

Overview

This article provides brief information on Security Event Manager (formerly Log & Event Manager) RAM and CPU requirements. 

As your SEM device count grows, the amount of data arriving to SEM grows too. The amount of Rules and filters may also grow. This will cause SEM to slow down. Your SEM will under perform.

Product section

Security Event Manager

Resolution

Pre-requisites:

  • No unmatched data
  • No Windows Filtering Platform noise
  • Less than 500 rules firing per day
  • No agent connection issues
  • RAW (NDepth) database is disabled.

 

Note: If one or more of the above is true then you should resolve those issues with the SolarWinds Support Geek Team.

 

To calculate the amount of messages SEM you should run the Database Maintenance report and check the Overview on page 1 of that report.
 

Alternatively you can loosely calculate by running an nDepth search for 1 hour and multiply by 24:

15 → 35 million events/day16GB of RAM & 4-CPUs
35 → 60 million events/day24GB of RAM & 6-CPUs
60 → 90 million events/day32GB of RAM & 8-CPUs
90 → 130 million events/day64GB of RAM & 10-CPUs
130 → 200 million events/day

128GB of RAM & 12-CPUs

200 → 400 million events/day

192GB of RAM & 14-CPUs

400 → 864 million events/day

256GB of RAM & 16-CPUs