IBM QRadar

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Absolut minimum HW config for EP

    Posted Wed November 06, 2019 04:56 AM
    Hi,

    I have a new client with a very small EPS (100). I'm going to use an EP to collect logs (surprisingly it can act as EC as well). I'm aware of the standard config of this appliance, but it is overkill for this, so what is the absolute minimum CPU and memory wise for an EP as a VM?

    Thank you
    Laszlo

    ------------------------------
    Laszlo Pal
    ------------------------------


  • 2.  RE: Absolut minimum HW config for EP

    Posted Thu November 07, 2019 04:45 AM
    I have had experiences where the setup has required me to add additional hardware upon installing the managed host, as they were below the minimum requirements - I haven't attempted to alter the hardware post deployment and wouldn't expect it to check again.

    Would be keen on knowing how "skinny" you can make a EP also.

    ------------------------------
    JH
    ------------------------------

    Original Message


  • 3.  RE: Absolut minimum HW config for EP

    Posted Thu November 07, 2019 06:06 AM
    Hi,

    After a quick test on my laptop, I've found 8 GB of RAM is the absolute minimum (with less, it will not install). It seems it is not sensitive to the cpu cores, since it is fine with only 2vcpu. Storage wise the minimum is somewhere 100GB.

    I'm not sure how it will work in production, but I'll test

    L:

    ------------------------------
    Laszlo Pal
    ------------------------------

    Original Message


  • 4.  RE: Absolut minimum HW config for EP

    Posted Fri November 08, 2019 03:04 AM
    Hi Laszlo,

    we also had this problem. 
    First be aware that there is a big difference between an EP and an EC. The EC is just collection events and then forwarding them to an EP. The EP on the other side is storing the events and also searching them if the console is telling it to do so. So there is more workload on an EP, more active processes.

    So you have different requirements for an EC than for an EP.

    Some requirements I found are:
    - you need 256GB of storage (I always take 300GB because the VM also needs to configure some swap and so on.)
    - don't miss the IOPS even for a very small system your disk performance should not be less than 300 IOPS. (with less your system will probably react slow and freeze time by time.

    Please see also this link:
    https://www.ibm.com/support/knowledgecenter/en/SS42VS_7.3.2/com.ibm.qradar.doc/c_siem_vrt_ap_reqs.html

    Minimum RAM requirement is 12GB with 7.3.2 (but as it is a VM you can cut this after the installation ;-) , I would recommend at least 8GB for an EP and 4 GB for an EC (not tested!)

    Minimum CPU requirement is 4 cores (I guess this is not so important, but as virtuell appliance how cares about cpu cores?)

    I hope this helps.

    Greetings Oliver


    ------------------------------
    Kind regards
    Oliver
    ------------------------------

    Original Message


  • 5.  RE: Absolut minimum HW config for EP

    Posted Fri November 08, 2019 04:48 AM

    Hi,

     

    Thank you. There are couple of things I need to add this

     

    • 4 GB RAM is not an option because install will complain about it, so what I've found 8 GB is the absolute minimum
    • Also based on real world experience EP/FP role can act as EC as well. Maybe it is some kind of undocumented feature allowing to save some resource for some small customers. We already have such vm-s, and IBM trainer recently confirmed EP can be EC as well. This is good especially for clients where you have to keep logs locally

     

    L:

     




    Original Message


  • 6.  RE: Absolut minimum HW config for EP

    Posted Fri November 08, 2019 05:01 AM
    Hi let me put this in the right place:

    A console always includes an internal EP and an internal EC component.
    An EP is always connected to one console and always includes an internal EC. Plus it can collect events from many dedicated ECs.
    An EC is always connected to one EP.

    Events are always stored on the device which holds the EP component where the events are processed.

    I hope this clear now?

    ------------------------------
    Kind regards
    Oliver
    ------------------------------

    Original Message


  • 7.  RE: Absolut minimum HW config for EP

    Posted Fri November 08, 2019 05:06 AM

    Yes, I think it is more precise, but still EP can be used as EC, and EP/FP as EC/FC which is for me is a very good news for those small customers, so I can save some resource :)

     

    Thx

    L:




    Original Message