1.3 System Requirements for Scalable Storage

This section provides sizing information based on the testing performed at Micro Focus with the hardware available to us at the time of testing. Your results may vary based on details of the hardware available, the specific environment, the specific type of data processed, and other factors. It is likely that larger, more powerful hardware configurations exist that can handle a greater load, and for even greater scalability Sentinel is explicitly designed to support distributed processing across multiple systems. If your environment is at all complex, consult with Micro Focus Consulting Services or any of the Sentinel partners prior to finalizing your Sentinel architecture as they have additional spreadsheets and tools to calculate architectural constraints.

The hardware requirements provided on this page are applicable only for Sentinel with the scalable storage option enabled. To perform functions that are not available with the scalable storage option, such as anomaly detection, you must install separate instances of Sentinel with traditional storage and route the specific event data to it by using Sentinel Link. In such a case, you must set up additional hardware for the traditional storage Sentinel servers based on the EPS you plan to filter and forward to the traditional storage Sentinel servers. For more information, see the hardware requirements for traditional storage.

1.3.1 Node Types

Grouping of services in the node types below is a suggested grouping aimed at achieving the following goals:
- Minimize the number of nodes so that it is easier to manage.
- Achieve good data reliability to avoid data loss even under typical system failure scenarios. Node redundancy is necessary to achieve this goal.
- Isolate services whose performance profile would conflict with each other under load. For example, both Elasticsearch and Kafka make use of operating system file system caching. This would result in conflict with each other and with other memory intensive services running on the same operating system.
Other arrangements of services can work very well if the goals of a scenario are different.
If the appliance installer is selected for the SSDM server, it must be run on a separate node from the Master since installing CDH services on the appliance is not recommended for maintainability purposes.
Each node can be a virtual machine or a bare-metal machine. For data reliability reasons, redundant nodes must be placed on separate bare-metal hardware. For example, if all nodes are virtual machines, then the minimum nodes for the Production System described below requires 3 bare-metal hosts with one virtual Worker node, one virtual Messaging node and one Indexing node on each bare-metal host.

Node Type	Services	Minimum Nodes for Production System
Worker	All Worker nodes include: HDFS DataNode HBase RegionServer YARN NodeManager Only 2 Worker nodes need: ZooKeeper Server	3
Messaging	All Messaging nodes include: Kafka Broker Only 1 Messaging node needs: HDFS SecondaryNameNode YARN Resource Manager (Standby)	3
Indexing	Elasticsearch	2
Master	Cloudera Management Services HBase Master HDFS NameNode YARN ResourceManager YARN JobHistory Server Spark History Server ZooKeeper Server Sentinel Scalable Data Manager (SSDM) Server (traditional installer)	1

Hardware Recommendations

Component	Recommendation
CPU	Intel(R) Xeon(R) CPU ES-2695 v2@ 2.40GHz
Master Node Data Storage	Reliable storage (such as fault tolerant RAID)
Worker and Messaging Node Data Storage	Operating system and application binaries and configuration: Fault tolerant RAID Data Storage Disks in JBOD (Just a Bunch Of Disks) configuration 7200 RPM SATA
Indexing Node Data Storage	Operating system and application binaries and configuration: Fault tolerant RAID Data Storage Disks in JBOD (Just a Bunch Of Disks) configuration SSD or 15000 RPM SATA
Network Technology	Bonded Gigabit Ethernet or 10 Gigabit Ethernet

1.3.2 System Sizing Information

8K EPS (Filtered data to Remote Correlation Engine, 4 Spark Jobs)

Layout of Services

Node Type	VM Nodes	vCPU per Node	vMemory (GB) per Node	Disks per Node
Worker	5	12	24	4
Messaging	4	4	32	3
Indexing	2	8	12	4
Master	1	16	32	1

Hardware Layout

Virtual Machines

Hardware Nodes

CPU per Node

Memory (GB) per Node

Disks per Node

1x Worker

1x Messaging

1x Indexing

1 (ESX1)

128, but only 68 will be used

1x Worker

1x Messaging

1x Indexing

1x Master

1 (ESX2)

128, but only 100 will be used

1x Worker

1x Messaging

1 (ESX3)

128, but only 58 will be used

CDH Setup Detail

		Components	RAM	CPU	HDD
Master (1)	Node1	HBase Master HDFS NameNode Cloudera Management Service Alert Publisher Cloudera Management Service Event Server Cloudera Management Service Host Monitor Cloudera Management Service Reports Manager Cloudera Management Service Service Monitor Spark History Server YARN (MR2 Included) JobHistory Server YARN (MR2 Included) ResourceManager ZooKeeper Server SSDM Server	32	12	500 GB
Messaging (3)	Node2	Kafka Broker	32	4	//dev/sda4 408G /kafka1/dev/sdb1 500G /kafka2/dev/sdc1 500G /kafka3
	Node3		32	4	/dev/sdb1 500G /kafka1/dev/sdc1 500G /kafka2/dev/sdd1 500G /kafka3
	Node4		32	4	/dev/sdb1 500G /kafka1/dev/sdc1 500G /kafka2/dev/sdd1 500G /kafka3
Worker (3)	Node5	HDFS DataNode HBase RegionServer YARN NodeManager	24	12	/dfs/dn 500G/dev/sdb1 500G /hdfs1/dev/sdc1 500G /hdfs3/dev/sdd1 500G /hdfs4
	Node 6		24	12	/dfs/dn 500G/dev/sdb1 500G /hdfs1/dev/sdc1 500G /hdfs3/dev/sdd1 500G /hdfs4
	Node 7		24	12	/dfs/dn 500G/dev/sdb1 500G /hdfs1/dev/sdc1 500G /hdfs3/dev/sdd1 500G /hdfs4
Indexing (2)	Node8	Elasticsearch	12	8	/dev/sda4 500G /es1/dev/sdb1 500G /es2/dev/sdd1 500G /es4/dev/sdc1 500G /es3
Indexing (2)	Node9	Elasticsearch	12	8	/dev/sda4 500G /es1/dev/sdb1 500G /es2/dev/sdd1 500G /es4/dev/sdc1 500G /es3

Sentinel Components

	Number of instances	CPU	Memory	Disk Space
Collector Manager	2	8 cores	8 GB	100 GB free space (fixed storage)
Correlation Engine	1	8 cores	8 GB	100 GB free space (fixed storage)

10K EPS (Filtered data to Remote Correlation Engine, 4 Spark Jobs)

Layout of Services

Node Type	VM Nodes	vCPU per Node	vMemory (GB) per Node	Disks per Node
Worker	5	12	24	4
Messaging	4	4	32	3
Indexing	2	8	12	4
Master	1	16	32	1

Hardware Layout

Virtual Machines	Hardware Nodes	CPU per Node	Memory (GB) per Node	Disks per Node
1x Worker 1x Messaging 1x Indexing	1 (ESX1)	24	128, but only 68 will be used	12
1x Worker 1x Messaging 1x Indexing 1x Master	1 (ESX2)	24	128, but only 100 will be used	12
1x Worker 1x Messaging	1 (ESX3)	16	128, but only 56 will be used	9
2x Worker 1x Messaging	1 (ESX4)	24	128, but only 24 will be used	12

CDH Setup Detail

		Components	RAM	CPU	HDD
Master (1)	Node1	HBase Master HDFS NameNode Cloudera Management Service Alert Publisher Cloudera Management Service Event Server Cloudera Management Service Host Monitor Cloudera Management Service Reports Manager Cloudera Management Service Service Monitor Spark History Server YARN (MR2 Included) JobHistory Server YARN (MR2 Included) ResourceManager ZooKeeper Server SSDM Server	32	12	500 GB
Messaging (3)	Node2	Kafka Broker	32	4	/dev/sda4 408G /kafka1/dev/sdb1 500G /kafka2/dev/sdc1 500G /kafka3
	Node3		32	4	/dev/sdb1 500G /kafka1/dev/sdc1 500G /kafka2/dev/sdd1 500G /kafka3
	Node4		32	4	/dev/sdb1 500G /kafka1/dev/sdc1 500G /kafka2/dev/sdd1 500G /kafka3
Worker (4)	Node5	HDFS DataNode HBase RegionServer YARN NodeManager	32	4	/dfs/dn 500G/dev/sdb1 500G /hdfs1/dev/sdc1 500G /hdfs3/dev/sdd1 500G /hdfs4
	Node 6		24	12	/dfs/dn 500G/dev/sdb1 500G /hdfs1/dev/sdc1 500G /hdfs3/dev/sdd1 500G /hdfs4
	Node 7		24	12	/dfs/dn 500G/dev/sdb1 500G /hdfs1/dev/sdc1 500G /hdfs3/dev/sdd1 500G /hdfs4
	Node8		24	12	/dfs/dn 500G/dev/sdb1 500G /hdfs1/dev/sdc1 500G /hdfs3/dev/sdd1 500G /hdfs4
Indexing (2)	Node9	Elasticsearch	12	8	/dev/sda4 500G /es1/dev/sdb1 500G /es2/dev/sdd1 500G /es4/dev/sdc1 500G /es3
Indexing (2)	Node10	Elasticsearch	12	8	/dev/sda4 500G /es1/dev/sdb1 500G /es2/dev/sdd1 500G /es4/dev/sdc1 500G /es3

Sentinel Components

	Number of instances	CPU	Memory	Disk Space
Collector Manager	2	8 cores	8 GB	100 GB free space (fixed storage)
Correlation Engine	1	8 cores	8 GB	100 GB free space (fixed storage)

11K EPS (Filtered data to Remote Correlation Engine, 4 Spark Jobs)

Layout of Services

Node Type	VM Nodes	vCPU per Node	vMemory (GB) per Node	Disks per Node
Worker	5	12	24	4
Messaging	4	4	32	3
Indexing	2	8	12	4
Master	1	16	32	1

Hardware Layout

Virtual Machines	Hardware Nodes	CPU per Node	Memory (GB) per Node	Disks per Node
1x Worker 1x Messaging 1x Indexing	1 (ESX1)	24	128, but only 68 will be used	12
1x Worker 1x Messaging 1x Indexing 1x Master	1 (ESX2)	24	128, but only 100 will be used	12
1x Worker 1x Messaging	1 (ESX3)	16	128, but only 56 will be used	9
2x Worker 1x Messaging	1 (ESX4)	24	128, but only 48 will be used	12

CDH Setup Detail

		Components	RAM	CPU	HDD
Master (1)	Node1	HBase Master HDFS NameNode Cloudera Management Service Alert Publisher Cloudera Management Service Event Server Cloudera Management Service Host Monitor Cloudera Management Service Reports Manager Cloudera Management Service Service Monitor Spark History Server YARN (MR2 Included) JobHistory Server YARN (MR2 Included) ResourceManager ZooKeeper Server SSDM Server	32	12	500 GB
Messaging (3)	Node2	Kafka Broker	32	4	/dev/sda4 408G /kafka1/dev/sdb1 500G /kafka2/dev/sdc1 500G /kafka3
	Node3		32	4	/dev/sdb1 500G /kafka1/dev/sdc1 500G /kafka2/dev/sdd1 500G /kafka3
	Node4		32	4	//dev/sdb1 500G /kafka1/dev/sdc1 500G /kafka2/dev/sdd1 500G /kafka3
Worker (5)	Node5	HDFS DataNode HBase RegionServer YARN NodeManager	32	4	/dfs/dn 500G/dev/sdb1 500G /hdfs1/dev/sdc1 500G /hdfs3/dev/sdd1 500G /hdfs4
	Node 6		24	12	/dfs/dn 500G/dev/sdb1 500G /hdfs1/dev/sdc1 500G /hdfs3/dev/sdd1 500G /hdfs4
	Node 7		24	12	/dfs/dn 500G/dev/sdb1 500G /hdfs1/dev/sdc1 500G /hdfs3/dev/sdd1 500G /hdfs4
	Node8		24	12	/dfs/dn 500G/dev/sdb1 500G /hdfs1/dev/sdc1 500G /hdfs3/dev/sdd1 500G /hdfs4
	Node9		24	12	/dfs/dn 500G/dev/sdb1 500G /hdfs1/dev/sdc1 500G /hdfs3/dev/sdd1 500G /hdfs4

Sentinel Components

	Number of instances	CPU	Memory	Disk Space
Collector Manager	3	8 cores	8 GB	100 GB free space (fixed storage)
Correlation Engine	1	8 cores	8 GB	100 GB free space (fixed storage)

12K EPS (Filtered data to Remote Correlation Engine, 4 Spark Jobs)

Layout of Services

Node Type	VM Nodes	vCPU per Node	vMemory (GB) per Node	Disks per Node
Worker	5	12	24	4
Messaging	4	4	32	3
Indexing	2	8	12	4
Master	1	16	32	1

Hardware Layout

Virtual Machines	Hardware Nodes	CPU per Node	Memory (GB) per Node	Disks per Node
1x Worker 1x Messaging 1x Indexing	1 (ESX1)	24	128, but only 68 will be used	12
1x Worker 1x Messaging 1x Indexing 1x Master	1 (ESX2)	24	128, but only 100 will be used	12
1x Worker 1x Messaging	1 (ESX3)	16	128, but only 56 will be used	9
2x Worker 1x Messaging	1 (ESX4)	24	128, but only 80 will be used	12

CDH Setup Detail

		Components	RAM	CPU	HDD
Master/Manager/SSDM Server (1)	Node1	HBase Master HDFS NameNode Cloudera Management Service Alert Publisher Cloudera Management Service Event Server Cloudera Management Service Host Monitor Cloudera Management Service Reports Manager Cloudera Management Service Service Monitor Spark History Server YARN (MR2 Included) JobHistory Server YARN (MR2 Included) ResourceManager ZooKeeper Server SSDM Server	32	12	500 GB
Messaging (4)	Node2	Kafka Broker	32	4	/dev/sda4 408G /kafka1 /dev/sdb1 500G /kafka2 /dev/sdc1 500G /kafka3
	Node3		32	4	dev/sdb1 500G /kafka1 /dev/sdc1 500G /kafka2 /dev/sdd1 500G /kafka3
	Node4		32	4	/dev/sdb1 500G /kafka1 /dev/sdc1 500G /kafka2 /dev/sdd1 500G /kafka3
	Node5		32	4	/dev/sdb1 500G /kafka1 /dev/sdc1 500G /kafka2 /dev/sdd1 500G /kafka3
Worker (5)	Node 6	HDFS DataNode HBase RegionServer YARN NodeManager	24	12	/dfs/dn 500G /dev/sdb1 500G /hdfs1 /dev/sdc1 500G /hdfs3 /dev/sdd1 500G /hdfs4
	Node 7		24	12	/dfs/dn 500G /dev/sdb1 500G /hdfs1 /dev/sdc1 500G /hdfs3 /dev/sdd1 500G /hdfs4
	Node8		24	12	/dfs/dn 500G /dev/sdb1 500G /hdfs1 /dev/sdc1 500G /hdfs3 /dev/sdd1 500G /hdfs4
	Node9		24	12	/dfs/dn 500G /dev/sdb1 500G /hdfs1 /dev/sdc1 500G /hdfs3 /dev/sdd1 500G /hdfs4
	Node10		24	12	/dfs/dn 500G /dev/sdb1 500G /hdfs1 /dev/sdc1 500G /hdfs3 /dev/sdd1 500G /hdfs4

Sentinel Components

	Number of instances	CPU	Memory	Disk Space
Collector Manager	3	8 cores	8 GB	100 GB free space (fixed storage)
Correlation Engine	1	8 cores	8 GB	100 GB free space (fixed storage)

SSDM Components	Number of instances	Disk Space
SSDM Server	1	100 GB free space (fixed storage)
Collector Managers
Correlation Engines

Storage Estimations (5K EPS)

CDH components	Total data nodes	Number of disks(per node)	Cluster Storage per day(all replicas) (in GB)	Cluster Storage per day(single replica) (in GB)	Notes
Messaging	3	3	900 (max 7 days retention by default)Replicas: 3X	300 (max 7 days retention by default)	Event Analytics topic(4 GB for 10min retention) Events and raw data
Worker	3	4	750Replicas: 3X	250	Events and raw data
Indexing	2	4	450Replicas: 2X	225	Events (Default event fields are indexed)
Master	1	1	N/A	100 GB free space (fixed storage)

Performance Test Details

Data Collection

	8000 EPS	10000 EPS	11000 EPS	12000 EPS
Collector Manager (CM) Distribution: The number of event sources and events per second load placed on each Collector Manager.	Local Embedded CM Not Used Remote CM #1 Event Sources: 175 EPS: 5100 Filtered: 0% Raw Data Enabled Remote CM #2 Event Sources: 175 EPS: 3000 Filtered: 0% Raw Data Enabled	Local Embedded CM Not Used Remote CM #1 Event Sources: 175 EPS: 5100 Filtered: 0% Raw Data Enabled Remote CM #2 Event Sources: 175 EPS: 5100 Filtered: 0% Raw Data Enabled	Local Embedded CM Not Used Remote CM #1 Event Sources: 175 EPS: 5100 Filtered: 0% Raw Data Enabled Remote CM #2 Event Sources: 175 EPS: 5100 Filtered: 0% Raw Data Enabled Remote CM #3 Event Sources: 175 EPS: 1000 Filtered: 0% Raw Data Enabled	Local Embedded CM Not Used Remote CM #1 Event Sources: 175 EPS: 5100 Filtered: 0% Raw Data Enabled Remote CM #2 Event Sources: 175 EPS: 3000 Filtered: 0% Raw Data Enabled Remote CM #3 Event Sources: 175 EPS: 2000 Filtered: 0% Raw Data Enabled
Collectors Used	Each of the following Collectors had their own Syslog server, parsing at the following EPS rates: Fortinet FortiGate 2011.1r3 RCM #1: 850 RCM #2: 500 Palo Alto Networks Firewall 2011.1r2 RCM #1: 850 RCM #2: 500 Dumballa Failsafe 2011.1r1 RCM #1: 850 RCM #2: 500 McAfee Firewall Enterprise 2011.1r4 RCM #1: 850 RCM #2: 500 Microsoft Active Directory and Windows 2011.1r7 RCM #1: 850 RCM #2: 500 Oracle Solaris 2011.1r2 RCM #1: 850 RCM #2: 500	Each of the following Collectors had their own Syslog server, parsing at the following EPS rates: Fortinet FortiGate 2011.1r3 RCM #1: 850 RCM #2: 850 Palo Alto Networks Firewall 2011.1r2 RCM #1: 850 RCM #2: 850 Dumballa Failsafe 2011.1r1 RCM #1: 850 RCM #2: 850 McAfee Firewall Enterprise 2011.1r4 RCM #1: 850 RCM #2: 850 Microsoft Active Directory and Windows 2011.1r7 RCM #1: 850 RCM #2: 85 Oracle Solaris 2011.1r2 RCM #1: 850 RCM #2: 850	Each of the following Collectors had their own Syslog server, parsing at the following EPS rates: Fortinet FortiGate 2011.1r3 RCM #1: 850 RCM #2: 850 RCM #3: 150 Palo Alto Networks Firewall 2011.1r2 RCM #1: 850 RCM #2: 850 RCM #3: 150 Dumballa Failsafe 2011.1r1 RCM #1: 850 RCM #2: 850 RCM #3: 150 McAfee Firewall Enterprise 2011.1r4 RCM #1: 850 RCM #2: 850 RCM #3: 150 Microsoft Active Directory and Windows 2011.1r7 RCM #1: 850 RCM #2: 850 RCM #3: 150 Oracle Solaris 2011.1r2 RCM #1: 850 RCM #2: 850	Each of the following Collectors had their own Syslog server, parsing at the following EPS rates: Fortinet FortiGate 2011.1r3 RCM #1: 850 RCM #2: 500 RCM #3: 200 Palo Alto Networks Firewall 2011.1r2 RCM #1: 850 RCM #2: 500 RCM #3: 200 Dumballa Failsafe 2011.1r1 RCM #1: 850 RCM #2: 500 RCM #3: 200 McAfee Firewall Enterprise 2011.1r4 RCM #1: 850 RCM #2: 500 RCM #3: 200 Microsoft Active Directory and Windows 2011.1r7 RCM #1: 850 RCM #2: 500 Oracle Solaris 2011.1r2 RCM #1: 850 RCM #2: 500 RCM #3: 200
Remote Correlation Engine	Remote CE #1 EPS utilization: 80% CR fire rate: 1%	Remote CE #1 EPS utilization: 80% CR fire rate: 1%	Remote CE #1 EPS utilization: 80% CR fire rate: 1%	Remote CE #1 EPS utilization: 80% CR fire rate: 1%
Total	Event Sources: 350 EPS: 8000 Filtered: 0%	Event Sources: 525 EPS: 10000 Filtered: 0%	Event Sources: 525 EPS: 11000 Filtered: 0%	Event Sources: 525 EPS: 12000 Filtered: 0%

Data Storage

How far into the past will users search for data on a regular basis?

Amount of locally cached data in Elasticsearch for higher search performance

7 days

What percentage of searches will be over data older than the number of days above?

Impacts the amount of input/output operations per second (IOPS) for Elasticsearch

10%

How far into the past must data be retained?

Impacts how much disk space is needed to retain all of the data. This also impacts the size of HBase and Elasticsearch.

90 days

User Activity

How many simultaneous users will be accessing the visualization dashboards at the same time, on average?	3
How many visualization dashboards will be running at the same time, on average?	3
How many widgets per visualization dashboard will be running at the same time, on average?	10
How many simultaneous visualization searches will be running at the same time, on average?	3
How many users will be accessing the Threat Response dashboard at the same time, on average?	3
How many Threat Response dashboards will be running at the same time, on average?	3
How many alert widgets (alert search queries) per dashboard will be running at the same time, on average?	2
How many real-time alert views will be running at the same time, on average?	3

Analytics

What percentage of the event data is relevant to correlation rules?

Amount of data the Correlation Engine will process.

100% (out of the box)

(10 correlations per second)

How many simple correlation rules (filter/trigger only) will be used?

Impacts the CPU utilization of the Correlation Engine.

114

(out of the box)

How many complex correlation rules will be used?

Impacts the CPU and memory utilization of the Correlation Engine.

(out of the box)

Correlation Engine (CE) Distribution

Local Embedded CE (75 rules)

Remote CE (40 rules)

How many alerts will be created?

30 per minute