Article Number
000001133
Applies To
RSA Product Set: ECAT
RSA Product/Service Type: ECAT
RSA Version/Condition: 4..0.x,4.1.x,4.2.x
Platform: Windows
Platform (Other): SQL 2012, SQL 2014
Issue
This is a how-to article dedicated to performance enhancements and otherwise advice on tuning the performance of the ECAT database.
Resolution
Recommendations
Database Performance/Tuning
It is necessary to understand what the minimum recommendations are and to remember that disk space is heavily influenced by the flow of data, along with most other factors in NetWitness Endpoint. For instance, if the QueuedData folder is inaccessible to the database, files will build in the folder over time, potentially consuming enormous amounts of space since agents will continue to check in with the console server and queue up data. So to start, it is good to begin with the recommended minimum specs for the database starting with the below:
- ECAT DB: 400GB @ 3000 IOPS* (+ 50Gb for Bit9 DB)##
- Temp DB: 100GB @ 1500 IOPS*
- DB Log: 100GB @ 1500 IOPS*
- Optional System DBs: 30Gb
Below is a table indicating guidelines regarding different size deployments. Typically, an ECAT deployment will start with 12 cores and expand from there, depending on number of agents and overall database performance.
Notes
SQL Server Best Practices
https://technet.microsoft.com/en-us/library/dd758814(v=sql.100).aspxBelow are the BPM query and Batches queries for reference
