Introduction
This article will explain the calculation of eps and disk usage area before installation.
EPS
Events per second is a term used in IT management to describe the number of events or transactions that occur on any IT device at a given time.
- EPS amounts help to determine the hardware capacity of Logsign Unified SecOps Platform servers.
- EPS shows the number of events from a certain source, an increase in EPS is observed when there is a problem or anomaly movement on this source.
EPS Calculation
EPS values can never be calculated with 100% accuracy, only average values can be considered.
For example, while the traffic log of users with internet access is usually "x", traffic may drop to "y" in a given period.
Factors affecting EPS values;
- organization users,
- security products,
- total assets.
An organization that manages 50 users and an organization that manages 5000+ users cannot expect EPS to be the same. According to these values, an average amount of EPS and the average area occupied by the disc can be determined according to the finding obtained from this value.
The line lengths in the incoming log are proportional to the disk size of a log, so the space the log will occupy on the disk differs according to security and system products.
The excel document at the bottom of the page can be used to calculate an average EPS.
Calculating Disk Size
Based on the information provided above, we use a simple formula to calculate the average disk size.
In Logsign, you can store logs in 2 or optionally 3 different ways.
- Index for analysis, reporting and dashboard,
- Compressed and parsed archive json cold data for retrospective log analysis
- Optional; For data integrity compliance, the compressed raw log is stored as signed cold raw data.
To calculate the minimum disk space, you need to consider the amount of data to be stored in Index and the amount of data to be stored as Archive,Signed.
Because fifteen days of data is critical to security, we recommend keeping logs in Index for at least fifteen days.
Archive Json Cold Data is the section where parsed logs are compressed. The compression ratio varies with the compression type. There is a ratio between 1/10 and 1/20 in these calculations.
The excel document at the bottom of the page can be used to calculate disk space usage with an average EPS.
Calculation Formula
You can use the formula below to calculate the disk with your daily index and cold data sizes kept in the system.
Disk calculation in Logsign Unified SecOps Platform
with Signed + Archive + Index;
(Daily signed size * Number of days) + (Daily Archive Size * Number of Days) + (Daily Index Size * Number of Days)
Example:
2 GB Archive * 365 = 730 GB
1GB Signed * 730 = 730GB
12GB Index * 15 = 180GB
Total = 1,640 GB
Disk calculation in Logsign Unified SecOps Platform
with Archive + Index;
(Daily Index size * Number of Days) + (Daily Archive Size * Number of Days)
Example:
2 GB Archive * 365 = 730 GB
12GB Index * 15 = 180GB
Total = 910 GB
We recommend that you have an extra 500GB of space in case of a possible increase in peaks.
We recommend filtering your unnecessary stored data using DPM, this way you will save disk space and performance.