Sizing your environment

Overview

A single Plixer Scrutinizer collector instance can scale up to 100,000 fps sustained with spikes up to 200,000 fps, collecting from up to 500 exporters per collector. A distributed cluster can scale up to 50 collectors. That allows for sustained 5Mfps (spikes to 10Mfps) from up to 25000 exporters.

Flows per second Flows per minute Flows per hour Flows per day
10K 600K 36M 864M
100K 6M 360M 8.6B
5M 300M 18B 432B

Processing 8.64 billion records a day will naturally require more than our minimum system specifications would allow for. This document will help you determine what resources are required.

Keep in mind there are many more factors than are outlined here, therefore requirements for some instances will vary.

Plixer Scrutinizer

This section contains information on Plixer Scrutinizer sizing.

Minimum specs

Our minimum system specifications are based on a max of 5kfps and 25 exporters. As system loads increase required resources will increase.

The big three

The big three variables are: CPUs, Memory, and Disk. Processing huge data volumes requires large amounts of all.

CPU: The requirements for CPU most closely correlates with the number of exporters coming in.

Memory: The requirements for memory most closely correlate with flow volume.

Disk: Disk IO closely correlates with flow rate. Disk size requirements will be a function of an organizations data retention needs.

Important

All recommendations are based off of DEDICATED resources and that SHARED CPUs, RAM, and disk may not perform up to the recommended levels.

If you are streaming to ML or an external data lake, collected flow rates will be 25% less or CPUs and RAM need to be 25% higher.

Single instance guidelines

../_images/cpu_memory.png

Important

Plixer Scrutinizer is an IO intensive product. We recommend 15K drives or SSDs in RAID 10 for the best performance.

Reporter resources

With a distributed Scrutinizer deployment a number of servers work in concert. The reporter(s) act as the coordinator for all servers and therefore require resources in proportion with the number of servers.

Minimum CPUs: 2x servers in a cluster

Recommended CPUs: 4x servers in a cluster

Minimum Memory: 2GB per server in a cluster

Recommended Memory: 4 GB per server in a cluster

Take for example a distributed cluster with 10 collectors plus a dedicated reporter where the reporter is not collecting any external flow data. That reporter still has minim specs of 20 cores (we recommend 40) and 20 GB of RAM (we recommend 40 GB).

Additional considerations

Disk IO: In virtualized environments disk configurations and performance characteristics can vary greatly. Plixer Scrutinizer is a disk intensive application and avoiding waiting on disk is critical. There are too many factors that go into load on disk:

  • Size in bytes of each flow record
  • Cardinality of flow data
  • Aggregation method selected

Features enabled: Overall load on a system will vary greatly depending on which features are being utilized and at what levels. Some of the features that can impact resource needs are:

  • Number of Flow Analytics algorithms enabled and how many data sources are enabled
  • Number of configured report thresholds
  • Number of scheduled reports

Important

All flows are not the same: Performance will vary greatly depending on the size and complexity of the flows being collected.

  • The simplest flow configuration is NetFlow v5, where each flow record is 48 bytes on the wire (excludes headers and Plixer enhancements. Bytes on disk will be different).
  • More complex IPFIX templates can be well over 200 bytes per flow and include come complex structures like variable length strings that require more CPU to decode.

Note

Multiple templates matter: Multiple flow templates can add load like an additional exporter would.

  • If an exporter is sending the same flows in two templates, for example sending both ingress and egress metered flows, the load on the system for one exporter feels just like two exporters.
  • Option templates are small amounts of data sent infrequently so system impact is minimal. Recommended specs assume each exporter will be sending an option template.
  • This document uses the measure of “exporter”, because it simplifies things in almost all cases. If an exporter is sending additional template(s) with flow records it is safes to count that exporter as 2+ exporters.

Plixer Machine Learning Engine

This section contains information on Plixer Machine Learning Engine sizing.

Important

For PSI an “asset” is a host, for PNI an “asset” is an exporter interface.

CPU

Rows are flow per second (FPS), columns are number of assets supported. Measurement in number of cores.

  50 100 150 200 250 300 350 400 450 500
10k 8 12 16 20 24 28 32 36 40 44
20k 12 14 18 22 26 30 34 38 42 46
30k 16 18 20 24 28 32 36 40 44 48
40k 20 22 24 26 30 34 38 42 46 50
50k 24 26 28 30 32 36 40 44 48 52
60k 28 30 32 34 36 38 42 46 50 54
70k 32 34 36 38 40 42 46 50 54 56
80k 36 38 40 42 44 46 50 54 56 56
90k 40 42 44 46 48 52 54 56 56 56
100k 44 46 48 50 52 54 56 56 56 56

Memory

Rows are FPS, columns are number of assets supported. Measurements in GB.

  50 100 150 200 250 300 350 400 450 500
10k 40 80 112 136 160 184 208 232 256 256
20k 80 112 136 160 184 208 232 244 256 288
30k 112 136 160 184 208 232 244 256 288 320
40k 136 160 184 208 232 244 256 288 320 352
50k 160 184 208 232 244 256 288 320 352 384
60k 184 208 232 244 256 288 320 352 384 416
70k 208 232 244 256 288 352 352 384 448 448
80k 232 256 288 320 352 384 416 448 480 480
90k 256 288 320 352 384 416 448 480 512 512
100k 256 288 320 352 384 416 448 480 512 512

Disk

Rows are FPS, columns are number of assets supported. Measurements in TB.

  50 100 150 200 250 300 350 400 450 500
10k .2 .4 .6 .8 1 1.2 1.4 1.6 1.8 2
20k .4 .6 .8 1 1.2 1.4 1.6 1.8 2 2.2
30k .6 .8 1 1.2 1.4 1.6 1.8 2 2.2 2.4
40k .8 1 1.2 1.4 1.6 1.8 2 2.2 2.4 2.6
50k 1 1.2 1.4 1.6 1.8 2 2.2 2.4 2.6 2.8
60k 1.2 1.4 1.6 1.8 2 2.2 2.4 2.6 2.8 3
70k 1.4 1.6 1.8 2 2.2 2.4 2.6 2.8 3 3.2
80k 1.6 1.8 2 2.2 2.4 2.6 2.8 3 3.2 3.4
90k 1.8 2 2.2 2.4 2.6 2.8 3 3.2 3.4 3.6
100k 2 2.2 2.4 2.6 2.8 3 3.2 3.4 3.6 3.6