Recommended hardware sizing for VM:s

[Mikael_A]

Hello!

I havn´t found any rough numbers for VM Sizing.

For example, let´s say we have 150 Devices, logging about 15Gb logs/day with about 5000 logs/s.

We are currently planning on getting a VM license and hardware for the build. But I am uncertain about the memory/CPU config.

Looking at a current 400C with roughly 30 devices and about 5GB/day, the memory in use is not much. The cpu usage is higher when generating reports.

So I am thinking about a 6 Core with HT, 16GB mem and ofc something like Intel 3510 drives in Raid 5.

Anyone have any VM data to share?

[awasfi_FTNT · Accepted solution]

http://www.fortinet.com/sites/default/files/productdatasheets/FortiAnalyzer-VM.pdf

[Mikael_A]

Well, that doesn´t give any good indication of good balance of the hardware.

[tecepeipe]

That seems enough.

Keep in mind that it is a database. But not an HR complex one.

Just full table scans and summarize.

4 cores with 8GB can handle large environments.

you are doubling it already.

You can start with that to evaluate how it behaves.

But raid5 is not ideal for databases. Try to use raid10 to improve performance.

[Mikael_A]

tecepeipe wrote:

That seems enough.

Keep in mind that it is a database. But not an HR complex one.

Just full table scans and summarize.

4 cores with 8GB can handle large environments.

you are doubling it already.

You can start with that to evaluate how it behaves.

But raid5 is not ideal for databases. Try to use raid10 to improve performance.

Hello & Thanks for you input.

I´ve checked the performance on both a 400C (our current old model) and in my lab with a single Intel 320 disc.

The information I found was noteworthy. It seems that somehow Fortinet managed to handle the database so that it is using maximum sequential real with QD = 32. Since I didn´t have any NvME drives availible for testing, I was unable to see if it scaled further.

The 3510 will scale really well in Raid 5. I think it´s an old misconception that the performance is inadequate and that it belongs to the slow HDD era.

We were first thinking of a FAN 1000D appliance. But since it´s based on HDD:s that will yeild horrible performance.

I can recommend http://www.intel.com/cont...rkload-raid-paper.html

[tecepeipe]

"RAID 10 provides the highest read-and-write performance of any one of the other RAID levels, but at the expense of using two times as many disks."

Source:

https://technet.microsoft.com/en-us/library/ms190764(v=sql.105).aspx

[Mikael_A]

Very helpfull....

No, not quite.

[AtiT]

Hi,

Just some info to compare.

We have FAZVM-64 with 4 x CPU 2.80Ghz + 8 GB RAM.

Currently 66 ADOMS created with 78 logging devices.

Logs: 18GB per day (7GB at weekend); Maximum 2300 logs/s

Average CPU usage around 5-10% and memory around 20%.

80% of devices logging via IPSec.