Practical deployment examples (Windows)

For the best performance, we recommend that you use Microsoft SQL Server as your ESET Security Management Center database. While ESET Security Management Center is compatible with MySQL, using MySQL can negatively impact system performance when working with large amounts of data including dashboards, threats and clients. The same hardware with Microsoft SQL Server is capable of handling about 10x the number of clients as with MySQL.

For testing purposes, each client stores about 30 logs in the database. Microsoft SQL Server uses large quantities of RAM to cache database data, so we recommend that you have at least as much memory as Microsoft SQL Server has on disk.

There is no easy way to calculate the exact amount of resources used by ESET Security Management Center since resources used will vary depending on your network configuration. Below are test results for common network configurations:

Test case - maximum of 5,000 clients connecting to ESMC Server

Test case - maximum of 100,000 clients connecting to ESMC Server

To achieve the optimum configuration for your needs, we recommend that you test with a smaller number of clients and slower hardware and project your system requirements based on test results.

TEST CASE (5,000 CLIENTS)

Hardware/software

Windows Server 2012 R2, x64 processor architecture

Microsoft SQL Server Express 2014

Intel Core2Duo E8400 @3 GHz

4 GB RAM

Seagate Barracuda 7200rpm, 1TB, 16MB cache, Sata 3.0 Gb/s

Results

ESMC Web Console is very responsive (less than 5s)

Average memory consumption:

oApache Tomcat 200 MB

oESMC Server 200 MB

oSQL Server Database 2 GB

Server replication performance 10 replications per second

Database size on disk 2 GB (5,000 clients, each with 30 logs in database)

For this example, SQL Server Express 2014 was used. In spite of its limits (10GB database, 1CPU and 1GB of RAM usage), this configuration was functional and performed well. Using SQL Server Express is recommended for servers with less than 5,000 clients. You can deploy SQL Server Express initially and upgrade to Microsoft SQL Server (full version) when a larger database becomes necessary.

Server replication performance defines a replication interval for clients. 10 replications per second results in 600 replications per minute. In an ideal case, the replication interval on all 5,000 clients should be set to 8 minutes, however this would incur a 100% load on the server so a longer interval is necessary in this case. In this example, a 20-30 minute replication interval is recommended.

TEST CASE (100,000 CLIENTS)

Hardware/software

Windows Server 2012 R2 Datacenter, x64 processor architecture

Microsoft SQL Server 2012

Intel Xeon E5-2650v2 @2.60GHz

64 GB RAM

Network adapter Intel NIC/PRO/1000 PT Dual

2x Micron RealSSD C400 256GB SSD Drives (one for system+software, second for SQL Server Data Files)

Results

Web Console is responsive (less than 30s)

Average memory consumption

oApache Tomcat 1 GB

oESMCServer 2 GB

oSQL Server Database 10 GB

Server replication performance 80 replications per second

Database size on disk 10 GB (100,000 clients, each with 30 logs in database)

In this case we chose to install Apache Tomcat + ESMC Web Console, ESMC Server on one machine and SQL Server on another machine, to test the capacity of the ESMC Server.

The large number of clients resulted in increased memory and disk usage by Microsoft SQL Server. SQL Server caches almost entirely from the database stored in memory for optimum performance. Apache Tomcat (Web Console) and ESMC Server cache data as well, which explains the increased memory usage in this example.

ESMC Server is capable of serving 80 replications per second (288,000 per hour), so in an ideal case, the replication interval on all 100,000 clients should be set to every ~30 minutes (load 200,000 replications per hour), but this will result in 100% server load, so the best replication interval to use would be 1 hour (100,000 replication per hour).

Network data usage depends on the number of logs harvested by clients. In this test, this number was about 20 KB per replication, so 80 replications per second gives us about 1600 KB/s (20 Mbit/s) network speed.