Appendix A. How NetWitness Platform Hosts Store DataAppendix A. How NetWitness Platform Hosts Store Data
In most deployments, NetWitness Platform Decoders, Log Decoders, Concentrators, Archivers, and Hybrid hosts require external storage to house their data. Each host uses the external storage in different ways and with different expectations on throughput and performance of the external storage. Some hosts have a higher occurrence of sequential writes and some hosts have a higher occurrence of random reads and writes.
Decoder Hosts
Log Decoders and Network Decoders capture data and parse meta. The difference between these two hosts is in the type of data they capture:
- Log Decoder captures logs.
- Network Decoder captures packets.
Both Log Decoders and Network Decoders parse out meta data from the raw captured traffic. The meta data is then aggregated to a Concentrator for indexing. The host requires storage to house the raw payload data (raw packets or raw logs) and a cache for the meta extracted during data capture for Concentrator aggregation.
Your retention requirements is a key factor in determining the amount of storage you need for the raw packets or raw logs. In most deployments, you add storage over time based on increased retention requirements and increased capture rates. The storage for the raw data must support a high amount of sequential writes with random reads. Especially in the case of higher speed Network Decoder environments, it is recommended to have a minimum of two partitions exposed to the host to support the throttling between partitions for reads and writes.
The meta cache on a Decoder is generally fixed in size but you can expand it to support additional cache the possible loss of connectivity between the Decoder and a corresponding Concentrator. The meta cache must support a random IOPS rate for sustained writes from the Decoder of meta extracted and the corresponding reads from the Concentrator as meta is aggregated to a Concentrator.
Concentrator Host
A Concentrator aggregates and indexes the meta data from a Decoder. Both the meta and index storage needs are scaled based on your NetWitness Platform deployment retention requirements. Similar to raw data stored on the Decoders, you may need to increase the storage for both meta data and index data over time to meet your retention requirements.
The meta storage houses all meta data extracted from either a Network Decoder or Log Decoder. Although the ratio of how much meta is extracted may change, the expectations for performance against meta storage is the same for both packet capture and log capture environments. The meta storage must support a sustained amount of sequential writes with random reads of meta data.
The index storage houses the live index generated from the meta data aggregated to a Concentrator. The size of the index is directly related to the size of the meta store. In addition to supporting IOPS for sustained writes, the index also needs to support a much higher rate IOPS for reads than meta based on interactive queries run through analyst interaction and reports and alerts.
Archiver Host
The Archiver host requires a single partition for both meta and raw log storage. The storage pool deals primarily with sequential writes for long term data written from a Log Decoder or Network Decoder and random reads for reports and analysis.
Hybrid Hosts
A Hybrid hosts two or more services on a single host. For example:
- A Network Hybrid hosts both the Decoder and Concentrator services handling packets exclusively. It captures packet data and indexes this data to the Concentrator service. Expectations for storage performance match what is outlined for a dedicated Network Decoder host and dedicated Concentrator host.
- A Log Hybrid hosts both the Log Decoder and Concentrator services handling logs exclusively. It captures log data and indexes the data to a Concentrator service. Expectations for performance match what is outlined for a dedicated Log Decoder and dedicated Concentrator.
- An Endpoint Log Hybrid hosts the Endpoint Server, Log Decoder, Concentrator, Log Collector, and Endpoint Broker services. It collects and manages endpoint (host) data from Windows, Mac, and Linux hosts, collects log files and Windows logs from Windows hosts, and generates metadata to correlate endpoint data with sessions from other events sources, such as logs and packets.
Options for SAN Configurations
If you want to use a Storage Area Network (SAN) , use the same basic drive groups and partition organization that you use for the other NetWitness storage devices. Depending on the SAN configuration and overhead, SAN configurations may require more enclosures and drives to operate with the same performance as on PowerVault or DAC. When deciding whether to use SAN, PowerVault, or DAC, any additional overhead on the SAN will be important to determine the minimum storage required.
Performance Recommendations
NetWitness recommends that Packet and Log Decoders receive two LUNs or Block Devices, one for Packet data, the other for all other databases. This allows you to segregate the high-bandwidth Packet Database from the other databases so they do not compete for I/O bandwidth with other activity.
Concentrators require a separate SSD-based index volume for best performance. You must house this index volume on a different RAID group than the Concentrator Meta database volume, which you can stored on NL-SAS. Archivers can use a single large NL-SAS storage volume per appliance.
Enable Security on SED Capable Drive groups on Host with a mix of SED and NON SED DrivesEnable Security on SED Capable Drive groups on Host with a mix of SED and NON SED Drives
The encryptSedVd.py may fail to identify the SED Capable Virtual Drives when there is mix of both SED and NON-SED drives on the appliance. The below steps are applicable when both SED and NON-SED capable virtual drives exist on the host.
- SSH to the appliance and enable security on the PERC H740 (mini) Adaptor. The controller number for this adaptor is 0. The PERC H840 Adaptor is shown as 1.
To list all the controllers on the appliance:
/opt/MegaRAID/perccli/perccli64 show | egrep -A3 'Model'
The first column (Ctl) lists out the controller index on the appliance. In this case, the controller ‘0’ corresponds to ‘PERC H740 Mini’ and controller ‘1’ corresponds to ‘PERC H840 Adaptor’ . The columns ‘DGs’ and ‘VDs’ displays the virtual drives and drive groups on the controller. - To enable the security on the ‘PERC H740 (mini) Adaptor’, for example, Controller ‘0’, execute the following command:
/opt/MegaRAID/perccli/perccli64 /c0 set securitykey=’<SOME_STRING_VALUE>’!' keyid=’< SOME_STRING_VALUE >’
Example:
/opt/MegaRAID/perccli/perccli64 /c0 set securitykey='NetWitness1!' keyid=1
'NetWitness1’ is the securityKey and ‘1’ is ID. Preserve both the Key and keyID securely. - Identify the correct Drive group (DG) / Virtual Drive (VD) corresponding to the SED Capable drives that you are trying to enable security.
/opt/MegaRAID/perccli/perccli64 /c0 /vall show | egrep -A5 'DG/VD'
Refer to first two and last column to identify the correct Drive Group (DG) / Virtual Drive (VD) correspond to the 6 SED enabled drives. On Series 6 appliances, there is only one DG/VD with RAID6. ‘NAME’ column can be used to identify the VD/DG. In this case, the DG/VD is ‘2’. Using a combination of ‘Type’, ‘Name’ and ‘Size’ columns (these are defined by the user when the VDs are created above). - To turn on Security on the disk group (created out of the 6 SED Capable drives), execute the below command:
/opt/MegaRAID/perccli/perccli64 /c0 /d2 set security=on - Get the Enclosure ID (EID) using on the controller ‘0’. In this case, it is ‘64’
/opt/MegaRAID/perccli/perccli64 /c0 /eall show - To confirm that the drives / Drive Groups (DG) are SED Enabled and Secured, run the below command and verify the SED Capable, Secured, SED Enabled flags are set as ‘Yes’ for drives in slots 4 (s4) through 9 (s9).
/opt/MegaRAID/perccli/perccli64 /c0 /e64/sall show all | egrep -i '(Policies/Settings |SED Capable|Secured|SED Enabled)'
Drive /c0/e64/s0 Policies/Settings :
SED Capable = No
SED Enabled = No
Secured = No
Drive /c0/e64/s1 Policies/Settings :
SED Capable = No
SED Enabled = No
Secured = No
Drive /c0/e64/s2 Policies/Settings :
SED Capable = No
SED Enabled = No
Secured = No
Drive /c0/e64/s3 Policies/Settings :
SED Capable = No
SED Enabled = No
Secured = No
Drive /c0/e64/s4 Policies/Settings :
SED Capable = Yes
SED Enabled = Yes
Secured = Yes
Drive /c0/e64/s5 Policies/Settings :
SED Capable = Yes
SED Enabled = Yes
Secured = Yes
Drive /c0/e64/s6 Policies/Settings :
SED Capable = Yes
SED Enabled = Yes
Secured = Yes
Drive /c0/e64/s7 Policies/Settings :
SED Capable = Yes
SED Enabled = Yes
Secured = Yes
Drive /c0/e64/s8 Policies/Settings :
SED Capable = Yes
SED Enabled = Yes
Secured = Yes
Drive /c0/e64/s9 Policies/Settings :
SED Capable = Yes
SED Enabled = Yes
Secured = Yes
