Security Compliance

SEM traffic limitations

This article discusses the amount of traffic that SEM can process per day.

First published date

10/12/2018 8:10 PM

Last published date

3/28/2019 4:42 PM

Overview

This article discusses the amount of traffic that Security Event Manager (formerly Log & Event Manager) can process.

Product section

Security Event Manager

Resolution

  • SEM traffic depends on the amount of resources available per the amount of tasks SEM is carrying out.
  • As a benchmark, SEM can process 200 Million events per day.
  • SEM resources can be used up if the following activities are performed by the events:
    • Run through filters on the GUI
    • Trigger rules
    • Trigger emails at the same time
  • The following is a guide of the number of resources used for every event:
    • 0->15 million events/day a 8GB of RAM & 2-CPUs (any combination of processors/cores/sockets)
    • 15->35 million events/day a 16GB of RAM & 4-CPUs
    • 35->60 million events/day a 24GB of RAM & 6-CPUs
    • 60->90 million events/day a 32GB of RAM & 8-CPUs
    • 90->130 million events/day a 64GB of RAM & 10-CPUs
    • 130->200 million events/day a128GB of RAM & 12-CPUs
      • Assumptions (Recommended setting reservations):
        • No unmatched data
        • No WFP noise
        • Less than 500 rules firing per day
        • No agent connection issues
        • RAW database is disabled
  • Enabling RAW database increases the capacity.
  • RAW DATABASE: = RAW Syslog or trap data - this is not enabled by default
  • If WFP is above 30% of data, rules firing above 5,000 per day, 500+/day duplicateAgent or 500+/day unknownAgent, or 10,000+/day unmatched,  increase the Reserved Memory.