Cisco Cisco Web Security Appliance S690
3
Release Notes for Web Security Advanced Reporting (Release 4.0)
Sizing & Scaling Recommendations
•
If the estimated requirements for indexed data volume exceed 100 K/Users (estimate: 100 GB/day,)
the Enterprise infrastructure should be adjusted.
the Enterprise infrastructure should be adjusted.
•
By adding another Enterprise instance and adjusting the configuration, the new infrastructure would
offer an increase in aggregate indexing and search performance (once the data is load-balanced), and
an increase in storage and retention capacity.
offer an increase in aggregate indexing and search performance (once the data is load-balanced), and
an increase in storage and retention capacity.
•
A dedicated forwarder server would also be added to the Enterprise infrastructure and configured to
monitor the WSA log files and forward the log data across multiple indexers using load balancing.
monitor the WSA log files and forward the log data across multiple indexers using load balancing.
•
To facilitate the implementation and configuration of an environment that exceeds 100K users, it is
recommended that you engage Professional Services.
recommended that you engage Professional Services.
Based upon log volume estimates against a Web Security Appliance with 10K users, the amount of data
collected is 10 GB/day uncompressed. Once indexed, the data compresses to an estimated 2.5 GB/day
indexed storage used. The Enterprise instance would retain approximately 200 days of indexed data
based upon a volume size of 500 GB.
collected is 10 GB/day uncompressed. Once indexed, the data compresses to an estimated 2.5 GB/day
indexed storage used. The Enterprise instance would retain approximately 200 days of indexed data
based upon a volume size of 500 GB.
Note
Guidelines based upon estimated log volumes and mid-capacity drives in an array.
Web Security
Appliance Users
Appliance Users
Estimated Log
Volume (2,500
transactions/user/day)
Volume (2,500
transactions/user/day)
Estimated
Indexed Volume
Indexed Volume
Estimated retention
(500 GB volume)
(500 GB volume)
10 K
10 GB/day
2.5 GB
200 days
50 K
50 GB/day
13 GB
40 days
100 K
100 GB/day
25 GB
20 days
Daily Volume
77 GB/day
140 GB/day
180 GB/day
Total Transactions
172 Million
325 Million
417 Million
Predefined Report
Load time
Load time
< 5 seconds
< 10 seconds
< 15 seconds
Total Volume
2.3 TB
Business days retention @70 GB/day
33
Predefined Report Loading time
< 20 seconds
Total Users
Daily Indexing Volume
< 2 GB/day
2 to 250
GB/day
GB/day
250 to 500
GB/day
GB/day
500 to 750
GB/day
GB/day
750GB to 1
TB/day
TB/day
1 to 2 TB/day 2 to 3 TB/Day
< 4
1 combined
instance
instance
1 Search
instance
instance
1 Indexer
1 Search
instance
instance
2 Indexers
1 Search
instance
instance
3 Indexers
1 Search
instance
instance
4 Indexers
1 Search
instance
instance
8 Indexers
1 Search
instance
instance
12 Indexers