Novell SENTINEL 6.1 SP2 - INSTALLATION GUIDE 02-2010 Installation Manual page 22

 Available hardware
Preferred operating systems

Plans for future scalability

 Amount of event filtering expected
Local data retention policies

Desired number and complexity of correlation rules

 Expected number of incidents per day
Expected number of workflows to be managed per day

Number of users logging in to the system

 Vulnerability and asset infrastructure
The most significant factor in the Sentinel system design is the event rate; almost every component
of the Sentinel architecture is affected by increasing event rates. In a high-event-rate environment,
the greatest demand is placed on the database, which is I/O-dependent and might be simultaneously
handling inserts of hundreds or thousands of events per second, object creation by multiple users,
workflow process updates, simple historical queries from the Sentinel Control Center, and long-term
reports from the Crystal Reports Server. Therefore, Novell makes the following recommendations:
 The database should be installed without any other Sentinel components.
The database server should be dedicated to Sentinel operations. Additional applications or

Extract Transform Load (ETL) processes might impact database performance.
The database server should have a high-speed storage array that meets the I/O requirements

based on the event insertion rates.
A dedicated database administrator should regularly evaluate and maintain the following

aspects of the database:
 Size
I/O operations

Disk space

 Memory
Indexing

Transaction logs

In low-event-rate environments (for example, EPS < 25), these recommendations can be relaxed,
because the database and other components use fewer resources.
This section includes some general hardware recommendations as guidance for Sentinel system
design. In general, design recommendations are based on event rate ranges. However, these
recommendations are based on the following assumptions:
 The event rate is at the high end of the EPS range.
The average event size is 600 bytes.

All events are stored in the database (that is, there are no filters to drop events).

 Thirty days worth of data is stored online in the database.
Storage space for Advisor data is not included in the specifications mentioned in the tables later

in this section.
22 Sentinel 6.1 Installation Guide