software mcafee epolicy orchestrator 4.6

26
Hardware Sizing and Bandwidth Usage Guide McAfee ePolicy Orchestrator 4.6.0 Software

Upload: others

Post on 24-Dec-2021

8 views

Category:

Documents


0 download

TRANSCRIPT

Page 1: Software McAfee ePolicy Orchestrator 4.6

Hardware Sizing and Bandwidth Usage Guide

McAfee ePolicy Orchestrator 4.6.0Software

Page 2: Software McAfee ePolicy Orchestrator 4.6

COPYRIGHTCopyright © 2011 McAfee, Inc. All Rights Reserved.

No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language in any form or byany means without the written permission of McAfee, Inc., or its suppliers or affiliate companies.

TRADEMARK ATTRIBUTIONSAVERT, EPO, EPOLICY ORCHESTRATOR, FOUNDSTONE, GROUPSHIELD, INTRUSHIELD, LINUXSHIELD, MAX (MCAFEE SECURITYALLIANCE EXCHANGE),MCAFEE, NETSHIELD, PORTALSHIELD, PREVENTSYS, SECURITYALLIANCE, SITEADVISOR, TOTAL PROTECTION, VIRUSSCAN, WEBSHIELD are registeredtrademarks or trademarks of McAfee, Inc. and/or its affiliates in the US and/or other countries. McAfee Red in connection with security is distinctive ofMcAfee brand products. All other registered and unregistered trademarks herein are the sole property of their respective owners.

LICENSE INFORMATION

License AgreementNOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETSFORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOUHAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANY YOURSOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR AFILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SETFORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OFPURCHASE FOR A FULL REFUND.

2 McAfee ePolicy Orchestrator 4.6.0 Software Hardware Sizing and Bandwidth Usage Guide

Page 3: Software McAfee ePolicy Orchestrator 4.6

Contents

Preface 5About this guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

Audience . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5Conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

Finding product documentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

1 Introduction 7Purpose of this guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

2 Calculating Hardware Requirements 9Types of servers used for testing . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

Considerations for outbreak response . . . . . . . . . . . . . . . . . . . . . . 10Recommendations for events per client per ASCI . . . . . . . . . . . . . . . . . . 10

Managed systems per server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10Agent Handler scalability . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

3 Bandwidth Usage 13Bandwidth requirements for initial deployment . . . . . . . . . . . . . . . . . . . . . . 13

Agent deployment and bandwidth . . . . . . . . . . . . . . . . . . . . . . . . 13Bandwidth requirements to deploy managed products . . . . . . . . . . . . . . . . . . . 14

Methods to minimize impact when deploying products . . . . . . . . . . . . . . . . 15Bandwidth recommendations for repository distribution . . . . . . . . . . . . . . . . . . 15

4 Concurrent Users 19Concurrent users and the effect on dashboard page loading . . . . . . . . . . . . . . . . 19

5 Database Sizing 21

A Appendix: Dashboard page load times 23

Index 25

McAfee ePolicy Orchestrator 4.6.0 Software Hardware Sizing and Bandwidth Usage Guide 3

Page 4: Software McAfee ePolicy Orchestrator 4.6

Contents

4 McAfee ePolicy Orchestrator 4.6.0 Software Hardware Sizing and Bandwidth Usage Guide

Page 5: Software McAfee ePolicy Orchestrator 4.6

Preface

This guide provides the information you need to configure, use, and maintain your McAfee product.

Contents

About this guide Finding product documentation

About this guideThis information describes the guide's target audience, the typographical conventions and icons usedin this guide, and how the guide is organized.

AudienceMcAfee documentation is carefully researched and written for the target audience.

The information in this guide is intended primarily for:

• Administrators — People who implement and enforce the company's security program.

ConventionsThis guide uses the following typographical conventions and icons.

Book title or Emphasis Title of a book, chapter, or topic; introduction of a new term; emphasis.

Bold Text that is strongly emphasized.

User input or Path Commands and other text that the user types; the path of a folder or program.

Code A code sample.

User interface Words in the user interface including options, menus, buttons, and dialogboxes.

Hypertext blue A live link to a topic or to a website.

Note: Additional information, like an alternate method of accessing an option.

Tip: Suggestions and recommendations.

Important/Caution: Valuable advice to protect your computer system,software installation, network, business, or data.

Warning: Critical advice to prevent bodily harm when using a hardwareproduct.

McAfee ePolicy Orchestrator 4.6.0 Software Hardware Sizing and Bandwidth Usage Guide 5

Page 6: Software McAfee ePolicy Orchestrator 4.6

Finding product documentationMcAfee provides the information you need during each phase of product implementation, frominstallation to daily use and troubleshooting. After a product is released, information about the productis entered into the McAfee online KnowledgeBase.

Task

1 Go to the McAfee Technical Support ServicePortal at http://mysupport.mcafee.com.

2 Under Self Service, access the type of information you need:

To access... Do this...

User documentation 1 Click Product Documentation.

2 Select a product, then select a version.

3 Select a product document.

KnowledgeBase • Click Search the KnowledgeBase for answers to your product questions.

• Click Browse the KnowledgeBase for articles listed by product and version.

PrefaceFinding product documentation

6 McAfee ePolicy Orchestrator 4.6.0 Software Hardware Sizing and Bandwidth Usage Guide

Page 7: Software McAfee ePolicy Orchestrator 4.6

1 Introduction

This document helps you determine the level of server hardware, system core, memory, storage, andnetwork bandwidth that McAfee recommends for the server-based components of your ePolicyOrchestrator software deployment.

This information can help you make hardware purchasing and provisioning decisions.

Purpose of this guideMcAfee has performed tests on different server-class systems to help you decide the hardwarerequirements for ePolicy Orchestrator deployment.

What is the goal?

• Assess and recommend the hardware required to support and manage environments of varying sizes.

What is being measured and determined?

• Number of agent communication transactions processed over a period of time.

• Peak transaction rates for each server configuration.

• Recommendations for the number of client systems a server can manage.

Which products were tested?

The following McAfee products were tested:

• Agent 4.6.0

• Application Control

• Change Control 5.1.0

• Change Reconciliation 5.1.0

• Email Gateway 5.6.1

• Endpoint Encryption for Files and Folders 4.0.0

• Endpoint Encryption for PC 6.1.0

• GroupShield for Microsoft Exchange 7.0.1

• Host Data Loss Prevention 9.1.0

• Host Intrusion Prevention 8.0.0

• Host Intrusion Prevention Content 3816

1

McAfee ePolicy Orchestrator 4.6.0 Software Hardware Sizing and Bandwidth Usage Guide 7

Page 8: Software McAfee ePolicy Orchestrator 4.6

• Integrity Control 5.1.0

• MOVE-AV for VDI (MOVE) 2.0.0

• Network Access Control 3.2.1

• Network Security Platform 6.0.1

• Policy Auditor 5.3.0

• Rogue System Detection 4.6.0

• Security for Microsoft SharePoint 2.5.0

• SiteAdvisor Enterprise Plus 3.0.0

• VirusScan Enterprise 8.8

• VirusScan Enterprise DAT 6334

• VirusScan Enterprise Engine 5400

• Vulnerability Manager 7.0.0

• Web Gateway 7.1.0

What effect does the product have on events and performance?

• An event from VirusScan Enterprise is essentially the same size as an event from McAfee HostIntrusion Prevention.

• Performance is determined by how many events a product generates.

1 IntroductionPurpose of this guide

8 McAfee ePolicy Orchestrator 4.6.0 Software Hardware Sizing and Bandwidth Usage Guide

Page 9: Software McAfee ePolicy Orchestrator 4.6

2 Calculating Hardware Requirements

McAfee provides hardware recommendations for the server-based components of your ePolicyOrchestrator deployment. Use these recommendations when allocating server hardware to host theePO server.

Contents

Types of servers used for testing Managed systems per server

Types of servers used for testingMcAfee conducted tests on a four-core ePolicy Orchestrator server with an eight-core database. Thefollowing are specifications for the ePolicy Orchestrator server, the database server, and the network.

ePolicy Orchestrator server specifications

• Four-core server system, Intel Xeon X5650 2.67 GHz

• 1 GB of RAM per core

• Windows 2008 Server R2, 64-bit

• RAID 5 array with internal SAS drives

Database server specifications

• Eight-core server system, Intel Xeon E7540 2.00 GHz

• 1 GB of RAM per core

• Windows 2008 Server R2, 64-bit

• SQL Server 2008, Service Pack 2, 64-bit

• RAID 5 array with internal SAS drives

McAfee recommends that in larger environments (>50,000 nodes), you store the Data and Logsdatabases on separate spindles in a RAID 1+0 configuration.

Agent Handler specifications

• Four-core server system, Intel Xeon X5650 2.67 GHz

• 1 GB of RAM per core

• Windows 2008 Server R2, 64-bit

• RAID 5 array with internal SAS drives

2

McAfee ePolicy Orchestrator 4.6.0 Software Hardware Sizing and Bandwidth Usage Guide 9

Page 10: Software McAfee ePolicy Orchestrator 4.6

Network specification

• 1000Base-T Ethernet

Considerations for outbreak responseWhen applying this data to your own environment, you must consider your outbreak responserequirements, including the response time and the number of systems.

Response time

The time period during which all systems must check in to the ePO server. The three factors thatdefine the response time in ePolicy Orchestrator are:

• Agent-to-server communication interval — You can configure the response time when settingthe agent-to-server communication interval (ASCI).

• Agent wake-up call — The agent wake-up call is initiated manually, but you can determine theresponse time by setting this period as the Agent randomization interval.

• Global updating — Once configured, global updating initiates updating automatically whenpackages are checked in. You can configure the response time by setting the randomization interval.

Although this information includes data for one to eight-hour response times, McAfee recommends aresponse time of no greater than six hours.

Number of systems

The number of managed systems that are required to check in within the response time.

Recommendations for events per client per ASCIMcAfee recommends < 25 events per client per ASCI. Use this formula to calculate the number ofclient events per ASCI in your environment.

Total number of events / number of client systems / ASCI per day (24/ASCI)

With your environment set up according to this recommendation, you can use the chart and tableunder Managed systems per server to calculate the number of client systems your server can managewith a given response time.

Managed systems per serverThe data in the following chart and tables shows the response times for managed systems.

These recommendations are conservative, based on test results that were significantly higher, in orderto accommodate instances of increased load. The calculations here are for an environment with <99events per client per ASCI. For the best performance, McAfee recommends an environment with <25events per client per ASCI.

2 Calculating Hardware RequirementsManaged systems per server

10 McAfee ePolicy Orchestrator 4.6.0 Software Hardware Sizing and Bandwidth Usage Guide

Page 11: Software McAfee ePolicy Orchestrator 4.6

Although the data is provided for one- to eight-hour response times, McAfee recommends a responsetime no greater than six hours.

Figure 2-1 Managed systems' response time

Table 2-1 Client systems managed by ePolicy Orchestrator 4.6.0

Required response time (hours) Four-core ePolicy Orchestrator server

Eight-core SQL server

1 66,000

2 133,200

3 199,800

4 266,400

5 333,000

6 399,600

7 466,200

8 532,800

Table 2-2 CPU usage of ePolicy Orchestrator 4.6.0 and database server

Required response time (hours) Four-core ePolicy Orchestrator server

Eight-core SQL server

1 ~100%

2 ~20%

Calculating Hardware RequirementsManaged systems per server 2

McAfee ePolicy Orchestrator 4.6.0 Software Hardware Sizing and Bandwidth Usage Guide 11

Page 12: Software McAfee ePolicy Orchestrator 4.6

Agent Handler scalabilityAdding distributed Agent Handlers to your managed environment can help you scale your network.

However, as the following figure shows, adding numerous Agent Handlers might result in diminishingreturns. This is the result of the fact that Agent Handlers must be in constant contact with the ePolicyOrchestrator database, and this connection can consume a significant amount of bandwidth.

Figure 2-2 Number of managed systems by number of Agent Handlers

Table 2-3 Client systems managed by ePolicy Orchestrator 4.6.0 with 1 hour ASCI

Number of distributed Agent Handlers Four-core Agent Handler

Eight-core SQL server

1 64,800

2 137,400

3 73,800

4 59,400

5 61,200

Due to the bottleneck on the database server, McAfee recommends distributing up to three AgentHandlers to ePolicy Orchestrator for a network site if the database server has eight cores or fewer.

If the ASCI value is more than one hour, multiply the number of client systems by your ASCI value.

2 Calculating Hardware RequirementsManaged systems per server

12 McAfee ePolicy Orchestrator 4.6.0 Software Hardware Sizing and Bandwidth Usage Guide

Page 13: Software McAfee ePolicy Orchestrator 4.6

3 Bandwidth Usage

This section identifies and describes the network traffic generated by ePolicy Orchestrator and itscomponents in a managed environment. It also covers product tuning information to help you balancebandwidth resources with the needs of the product.

Use this information when customizing your deployment strategies and policy settings, to maximizenetwork efficiency and ensure that you do not exceed the bandwidth limitations of your environment.

Contents

Bandwidth requirements for initial deployment Bandwidth requirements to deploy managed products Bandwidth recommendations for repository distribution

Bandwidth requirements for initial deploymentWhen implementing ePolicy Orchestrator in your environment, you must distribute agents,components, and security products to manage and protect the systems on the network.

Agent deployment and bandwidthDuring the initial setup of the managed environment, deploying the agent generates enough networktraffic that we recommend planning the deployment. Although the installation package for the agent issmaller than those of other products (such as VirusScan Enterprise), the agent must be deployed toeach client system you want to manage.

This table shows the total bandwidth used on an ePO server, client system, and database server foragent 4.6.0 deployment.

Table 3-1 Agent 4.6.0 deployment

Agent deployment Total (MB) Tx (MB) Rx (MB)

ePolicy Orchestrator server 5.04 4.83 0.21

Client system 4.64 0.04 4.60

Database server 0.42 0.18 0.24

Actual deployment

The first and most extensive use of bandwidth occurs when the agent installation package is deployedto client systems. You can deploy the agent installation package from the ePolicy Orchestrator consoleto sites, groups, or systems in the System Tree. Regardless of the method you use, deploying theagent installation package over the network generates traffic to each system.

Base the agent deployment on the number of client systems you plan to manage, their location in thenetwork topology, and the amount of bandwidth you have available between the ePO server and thesesystems.

3

McAfee ePolicy Orchestrator 4.6.0 Software Hardware Sizing and Bandwidth Usage Guide 13

Page 14: Software McAfee ePolicy Orchestrator 4.6

McAfee recommends deploying agents:

• In stages — Do not push network utilization over 80% at any time for a given segment of resources.

• To individual sites or groups — This is especially important if you have more bandwidth-limitingfactors such as slower connections between geographic locations.

Location of network impact

Agent-deployment traffic occurs directly between the ePolicy Orchestrator server and the systems towhich the agent is deployed.

Bandwidth requirements to deploy managed productsDeploying security products such as VirusScan Enterprise to client systems can be the mostbandwidth-intensive part of setting up a managed environment. Like the agent, security softwaremust be installed on each system you plan to manage.

This table shows the total bandwidth (in megabytes) used to deploy specific managed products, aswell as the data transmitted and received by the ePolicy Orchestrator server, a client system, and thedatabase server.

Table 3-2 McAfee product deployment

ProductDeployment

ePO server SQL server Client system

Total(MB)

Tx(MB)

Rx(MB)

Total(MB)

Tx(MB)

Rx(MB)

Total(MB)

Tx(MB)

Rx(MB)

Diskspace(MB)

Agent 4.6.0 5.04 4.83 0.21 0.42 0.18 0.24 4.64 0.04 4.60 33.90

EndpointEncryption forFiles andFolders 4.0.0

9.91 5.21 4.70 6.14 4.61 1.53 3.77 0.09 3.67 22.92

EndpointEncryption forPC 6.1.0

174.79 17.04 0.44 0.50 0.29 0.22 16.98 0.15 16.83 11.29

GroupShieldEnterprise7.0.0

129.81 114.02 15.79 19.15 14.49 4.66 110.66 1.30 109.36 531.41

Host Data LossPrevention9.1.0

31.47 16.85 14.62 18.75 14.38 4.38 12.71 0.24 12.47 126.78

Host IntrusionPrevention8.0.0

13.67 13.29 0.38 0.57 0.25 0.32 13.10 0.13 12.97 43.02

McAfeeNetworkAccess Control3.2.0

14.86 14.47 0.39 0.85 0.25 0.60 14.30 0.14 14.16 16.51

MOVE-AV 2.0 8.88 8.54 0.34 0.63 0.27 0.36 8.25 0.07 8.18 6.00

Security forMicrosoftSharePoint2.5.0

191.04 155.07 35.98 45.58 34.39 11.19 145.47 1.59 143.88 610.94

3 Bandwidth UsageBandwidth requirements to deploy managed products

14 McAfee ePolicy Orchestrator 4.6.0 Software Hardware Sizing and Bandwidth Usage Guide

Page 15: Software McAfee ePolicy Orchestrator 4.6

Table 3-2 McAfee product deployment (continued)

ProductDeployment

ePO server SQL server Client system

Total(MB)

Tx(MB)

Rx(MB)

Total(MB)

Tx(MB)

Rx(MB)

Total(MB)

Tx(MB)

Rx(MB)

Diskspace(MB)

Policy Auditor5.3.0

24.41 23.82 0.60 0.94 0.39 0.55 23.47 0.21 23.26 46.31

Rogue SystemDetection 4.6.0

5.74 5.53 0.21 0.31 0.15 0.16 5.44 0.06 5.37 5.46

Site AdvisorEnterprise3.0.0

5.25 5.01 0.23 0.75 0.47 0.06 4.78 0.05 4.73 15.43

Solidcore 5.1.0 12.62 11.88 0.73 1.34 0.63 0.71 11.28 0.10 11.18 35.70

VirusScanEnterprise8.8.0

97.19 95.48 1.72 2.52 1.01 1.51 94.67 0.71 93.96 320.55

Methods to minimize impact when deploying productsConsider these suggestions to minimize traffic generated by deploying products.

• Deploy the product to segments of the System Tree, rather than all systems at once. For example,schedule the deployment task to run for one group at a time.

• Use randomization intervals to distribute the deployment to a group over a period of time.

• Schedule the deployment task to run at local time, which is the default setting. This is helpful ifyour enterprise has offices in different time zones.

• Create and configure distributed repositories to localize network traffic during product deployment.Before running the deployment task, replicate the deployment package from the master repositoryto the distributed repositories. The deployment task generates traffic between the agent and thenearest repository only. However, after an installation, the agent sends properties to the server.Updating from the closest distributed repository localizes the traffic for product deployment.

Bandwidth recommendations for repository distributionIf the ePO server is managing systems across the Wide Area Network (WAN), McAfee recommendsthat you create distributed repositories on each Local Area Network (LAN) for client updates.

McAfee recommends that you create at least one distributed repository per LAN.

Number of distributed repositories

Systems in LAN Network Bandwidth (LAN)

100 Mbps 1 Gbps

1,000 1 1

2,000 2 1

3,000 3 1

4,000 4 1

5,000 5 1

10,000 10 2

Bandwidth UsageBandwidth recommendations for repository distribution 3

McAfee ePolicy Orchestrator 4.6.0 Software Hardware Sizing and Bandwidth Usage Guide 15

Page 16: Software McAfee ePolicy Orchestrator 4.6

Systems in LAN Network Bandwidth (LAN)

100 Mbps 1 Gbps

20,000 20 2

30,000 30 3

Recommendations for the server

If WAN bandwidth is 6 Mbps, approximately two distributed repositories are updated per minute.McAfee recommends following these steps to avoid network bandwidth saturation.

1 Create an incremental replication task for each distributed repository in each LAN.

2 According to bandwidth (WAN) in Mbps, set each task to run sequentially at the minimum of theminutes of the corresponding randomization interval, to avoid overlap.

Bandwidth (WAN) Randomization interval (minutes)

6 Mbps 1

5 Mbps 2

4 Mbps 3

3 Mbps 4

2 Mbps 5

1 Mbps 6

Recommendations for each client

1 Add the local distributed repository to the repository list in the agent policy.

2 Select the repository by Ping Time.

3 Create an agent update task with a randomization interval according to this table.

Table 3-3 Recommended interval (minutes) for 1 Gbps network bandwidth

Systems in LAN Distributed repositories in LAN

1 2 3

1,000 5 0 0

2,000 10 5 0

3,000 15 10 0

4,000 20 15 5

5,000 30 20 10

10,000 60 40 20

20,000 120 80 40

30,000 180 120 60

Table 3-4 Recommended interval (minutes) for 100 Mbps network bandwidth

Systems in LAN Distributed repositories in LAN

1 2 3 4 5

1,000 60 30 20 15 10

2,000 120 60 40 30 20

3 Bandwidth UsageBandwidth recommendations for repository distribution

16 McAfee ePolicy Orchestrator 4.6.0 Software Hardware Sizing and Bandwidth Usage Guide

Page 17: Software McAfee ePolicy Orchestrator 4.6

Table 3-4 Recommended interval (minutes) for 100 Mbps network bandwidth (continued)

Systems in LAN Distributed repositories in LAN

1 2 3 4 5

3,000 180 90 60 45 30

4,000 240 120 80 60 40

5,000 300 150 100 75 50

Bandwidth UsageBandwidth recommendations for repository distribution 3

McAfee ePolicy Orchestrator 4.6.0 Software Hardware Sizing and Bandwidth Usage Guide 17

Page 18: Software McAfee ePolicy Orchestrator 4.6

3 Bandwidth UsageBandwidth recommendations for repository distribution

18 McAfee ePolicy Orchestrator 4.6.0 Software Hardware Sizing and Bandwidth Usage Guide

Page 19: Software McAfee ePolicy Orchestrator 4.6

4 Concurrent Users

The ePolicy Orchestrator server is able to handle multiple user (http) requests. McAfee has calculatedthe results of the average page load time versus the number of concurrent user requests with data of100,000 managed nodes plus 13,000,000 events and 100,000 RSD Detected System Properties.

Concurrent users and the effect on dashboard page loadingPage load time is the time it takes the ePolicy Orchestrator server to respond to a user request to fullyload a dashboard page in the web browser.

Test scenario

• A number of users concurrently launched a specific dashboard.

• When the dashboard was fully loaded, each user refreshed the dashboard immediately andrepeated this 20 times.

The following chart shows the average dashboard page load time across all dashboards for all testedproducts (those listed in the "Which products were tested" section in the Purpose of this guide. Adetailed listing of load times by user for each product is included in Appendix A: Complete dashboardpage load time by number of users.

Average dashboard load time by number of users

4

McAfee ePolicy Orchestrator 4.6.0 Software Hardware Sizing and Bandwidth Usage Guide 19

Page 20: Software McAfee ePolicy Orchestrator 4.6

4 Concurrent UsersConcurrent users and the effect on dashboard page loading

20 McAfee ePolicy Orchestrator 4.6.0 Software Hardware Sizing and Bandwidth Usage Guide

Page 21: Software McAfee ePolicy Orchestrator 4.6

5 Database Sizing

When planning for hardware purchase, an important factor to consider is the amount of storage spaceyou will need.

Beyond the initial installation of ePolicy Orchestrator to a server, the portion of your environment thatexperiences the most growth is the database.

Consider the data in these tables to plan appropriately for your database storage needs.

Table 5-1 ePolicy Orchestrator installation size

Requirement Size (MB)

Database 826.25

Database transaction log 235.56

Total 1061.81

Table 5-2 Database size requirements

Requirement Size (KB)

For a client system 30.72

For an event 1.74

Calculating database size requirements

To calculate the size of the database, use this formula: Installed database size + (number of clients xclient system size) + (number of events generated x event size).

For example, in an environment with 1,000 clients and 10,000 events, the calculation is 1061.81MB +(1,000 x 30.72KB) + (10,000 x 1.74KB) = 1108.80MB.

The following table lists the size of the database, based on the number of events generated and thenumber of client systems being managed. Use this data to plan appropriately for your storage needs.

Table 5-3 Database size by number of events and client systems

Events System nodes

500 1,000 5,000 10,000 50,000 100,000 150,00 200,000 250,000 300,000

0 1,077 1,092 1,212 1,362 2,562 4,062 5,562 7,062 8,562 10,062

10,000 1,094 1,109 1,229 1,379 2,579 4,079 5,579 7,079 8,579 10,079

20,000 1,111 1,126 1,246 1,396 2,596 4,096 5,596 7,096 8,596 10,096

30,000 1,128 1,143 1,263 1,413 2,613 4,113 5,613 7,113 8,613 10,113

40,000 1,145 1,160 1,280 1,430 2,630 4,130 5,630 7,130 8,630 10,130

50,000 1,162 1,177 1,297 1,447 2,647 4,147 5,647 7,147 8,647 10,147

60,000 1,179 1,194 1,314 1,464 2,664 4,164 5,664 7,164 8,664 10,164

5

McAfee ePolicy Orchestrator 4.6.0 Software Hardware Sizing and Bandwidth Usage Guide 21

Page 22: Software McAfee ePolicy Orchestrator 4.6

Table 5-3 Database size by number of events and client systems (continued)

Events System nodes

500 1,000 5,000 10,000 50,000 100,000 150,00 200,000 250,000 300,000

70,000 1,196 1,211 1,331 1,481 2,681 4,181 5,681 7,181 8,681 10,181

80,000 1,213 1,228 1,348 1,498 2,698 4,198 5,698 7,198 8,698 10,198

90,000 1,230 1,245 1,365 1,515 2,715 4,215 5,715 7,215 8,715 10,215

100,000 1,247 1,262 1,382 1,532 2,732 4,232 5,732 7,232 8,732 10,232

110,000 1,264 1,279 1,399 1,549 2,749 4,249 5,749 7,249 8,749 10,249

120,000 1,281 1,296 1,416 1,566 2,766 4,266 5,766 7,266 8,766 10,266

130,000 1,298 1,313 1,433 1,583 2,783 4,283 5,783 7,283 8,783 10,283

140,000 1,315 1,330 1,450 1,600 2,800 4,300 5,800 7,300 8,800 10,300

150,000 1,332 1,347 1,467 1,617 2,817 4,317 5,817 7,317 8,817 10,317

160,000 1,349 1,364 1,484 1,634 2,834 4,334 5,834 7,334 8,834 10,334

170,000 1,366 1,381 1,501 1,651 2,851 4,351 5,851 7,351 8,851 10,351

180,000 1,383 1,398 1,518 1,668 2,868 4,368 5,868 7,368 8,868 10,368

190,000 1,400 1,415 1,535 1,685 2,885 4,385 5,885 7,385 8,885 10,385

200,000 1,417 1,432 1,552 1,702 2,902 4,402 5,902 7,402 8,902 10,402

5 Database Sizing

22 McAfee ePolicy Orchestrator 4.6.0 Software Hardware Sizing and Bandwidth Usage Guide

Page 23: Software McAfee ePolicy Orchestrator 4.6

A Appendix: Dashboard page load times

The following table provides a detailed list of dashboard page load times by product and number of users.

Page load time is the time it takes the ePolicy Orchestrator server to respond to a user request to fullyload a dashboard page in the web browser. For more information on the test scenario in which thisdata was generated, see Concurrent users and the effect on dashboard page loading.

Table A-1 Dashboard page load times by number of users

Dashboard Load time (seconds) by number of users

1 5 10 20 30 40 50 60 70 80 90 100

Audit 1.27 2.82 5.07 10.64 15.48 23.78 30.10 33.05 40.42 50.16 52.69 55.68

DLP: StatusSummary

1.72 2.85 6.44 11.99 17.77 23.91 32.35 34.07 39.13 45.77 52.54 63.74

EWS Dashboard 1.33 4.48 5.43 10.02 15.80 21.57 23.60 31.33 38.30 45.38 57.19 53.22

EndpointEncryption

1.11 2.90 4.93 10.92 15.34 23.03 28.74 35.54 41.01 43.29 45.02 58.66

ExecutiveDashboard

1.23 3.13 5.04 9.62 15.11 19.52 24.58 31.09 41.15 46.16 55.16 57.25

GroupShield forExchange 7.0

1.48 2.67 5.56 10.33 16.78 20.16 28.90 30.76 38.36 52.23 47.54 56.67

Host IPS:Dashboard

1.35 4.47 6.73 10.48 15.87 22.73 30.55 35.72 42.15 50.10 54.17 58.44

Host IPS: TriggeredSignature

1.50 2.64 5.56 11.12 15.98 21.82 32.78 36.08 43.34 52.90 53.57 64.73

MEG ActivityDashboard

1.16 4.52 6.37 10.02 16.42 23.34 30.57 34.86 42.82 48.45 52.84 60.20

MEG Server Status 1.07 2.51 4.36 10.09 15.78 21.84 27.77 27.60 39.35 47.19 57.31 60.14

MRA Rollup: RiskAdvisory

1.49 2.75 4.77 11.34 16.18 20.16 29.11 30.66 39.04 44.53 52.52 52.44

MRA: Threat ActionAdvisory

1.31 2.58 4.62 9.87 15.40 20.46 28.80 29.31 42.19 42.91 56.42 58.38

MRA: ThreatDashboard

1.43 2.83 4.81 10.82 15.75 20.88 29.68 32.15 39.71 36.50 54.20 58.71

MVM Summary 1.33 2.55 4.51 10.61 16.24 20.22 29.28 31.07 41.13 42.01 48.87 56.68

MVM WebAssessmentSummary

1.58 2.70 5.19 10.99 16.36 23.42 26.23 32.18 40.03 44.66 52.19 59.94

MWG 6.xDashboard

1.33 2.70 4.15 10.62 16.89 23.44 32.15 31.63 39.39 40.53 55.32 54.66

MWG 7 Dashboard 1.39 2.61 5.06 10.47 16.71 23.32 30.87 31.28 38.03 41.33 47.24 57.94

McAfee ePolicy Orchestrator 4.6.0 Software Hardware Sizing and Bandwidth Usage Guide 23

Page 24: Software McAfee ePolicy Orchestrator 4.6

Table A-1 Dashboard page load times by number of users (continued)

Dashboard Load time (seconds) by number of users

1 5 10 20 30 40 50 60 70 80 90 100

NAC Summary 1.34 2.66 5.24 11.74 16.92 23.45 30.49 34.81 36.48 46.53 51.24 57.20

NSP NetworkSecurity PlatformSummary

1.45 2.88 5.38 11.44 16.45 24.28 26.96 36.38 41.98 54.11 53.39 58.24

PA: ComplianceSummary

1.69 2.61 5.77 10.93 18.20 23.89 29.31 31.59 44.11 45.68 55.62 61.82

PA: MS PatchStatus Summary

1.56 2.56 5.53 10.40 17.62 23.02 30.08 34.13 43.67 39.64 50.99 55.23

PA: PCI Summary 1.87 2.92 6.00 11.28 16.70 23.47 29.09 35.71 39.93 44.42 52.08 53.57

PortalShield forSharePoint

1.34 2.88 5.33 10.12 15.74 23.20 28.99 33.69 41.68 36.61 53.86 62.71

ProductDeployment

1.55 2.90 5.77 9.75 16.96 23.79 31.69 32.38 39.96 50.54 49.02 60.47

RSD Summary 1.45 2.89 5.72 10.76 16.12 22.55 28.43 32.06 39.05 38.05 47.32 62.90

SAE+: Activity 1.44 2.58 5.42 10.76 16.44 22.04 26.54 31.67 40.33 46.12 53.73 60.44

SAE+: Authorize/Prohibit Lists

1.37 2.52 5.19 10.70 16.17 22.25 30.47 37.71 34.83 47.44 53.83 55.34

SAE+: ContentSummary

1.49 2.55 5.31 10.24 16.75 21.10 28.26 31.40 37.57 47.48 53.18 59.97

SAE+: SecuritySummary

1.38 2.65 5.41 10.81 17.18 21.61 30.90 31.12 41.92 45.52 47.01 51.74

SAE+: SingleRating Factor Block/Warn

1.63 2.50 5.69 10.51 16.16 22.32 29.00 34.29 43.04 50.68 53.70 51.12

SAE+: Warned/Blocked

1.32 4.01 5.21 10.79 15.25 22.67 27.87 36.54 44.78 40.95 55.07 63.10

Solidcore:Application Control

1.43 4.38 5.20 11.05 16.08 23.55 62.26 35.70 42.62 46.55 55.46 63.40

Solidcore: ChangeControl

1.44 2.49 5.44 10.47 16.99 22.46 29.10 32.41 41.28 41.56 56.56 57.98

Solidcore: IntegrityMonitor

1.64 2.64 6.19 12.33 17.35 23.99 28.73 33.48 37.31 48.43 50.51 55.16

Threat Events 1.57 2.56 5.09 9.59 15.79 23.02 30.55 32.17 44.82 49.60 51.74 54.60

Trends 1.50 2.45 5.60 10.15 17.21 23.41 30.28 37.30 41.51 45.70 59.87 59.57

VSE: CurrentDetections

1.64 2.52 5.65 10.22 17.48 23.67 28.56 35.29 40.44 43.86 56.44 61.06

VSE: Trending Data 1.47 2.47 5.64 10.22 17.54 21.79 28.13 31.96 42.04 50.69 51.52 63.93

ePO Summary 1.43 2.80 5.96 10.81 15.05 22.94 29.52 37.47 41.17 51.32 51.34 61.81

Average Page LoadTime (seconds)

1.44 2.90 5.39 10.64 16.41 22.51 30.03 33.27 40.67 45.78 52.78 58.43

A Appendix: Dashboard page load times

24 McAfee ePolicy Orchestrator 4.6.0 Software Hardware Sizing and Bandwidth Usage Guide

Page 25: Software McAfee ePolicy Orchestrator 4.6

Index

A

about this guide 5

C

conventions and icons used in this guide 5

D

documentationaudience for this guide 5product-specific, finding 6

documentation (continued)typographical conventions and icons 5

M

McAfee ServicePortal, accessing 6

S

ServicePortal, finding product documentation 6

T

Technical Support, finding product information 6

McAfee ePolicy Orchestrator 4.6.0 Software Hardware Sizing and Bandwidth Usage Guide 25

Page 26: Software McAfee ePolicy Orchestrator 4.6

00