IBM QRadar

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only

  • 1.  QROC Data Gateway

    Posted 02/26/20 09:16 AM
    Hi All, Can someone please help in storage and Memory requirement for Data Gateway  ? I have few questions so please bare with me 

    1) I followed the calculation formula provided by IBM "(events per second) * (average event size + normalized event size + (number of event indexes * 5bytes) ) * ( retention in days * seconds per day)" and found we require around 10TB space. But is this 10TB for Data Gateway or the Event Processor storage on cloud ? I understand Data Gateway is responsible for Data collections do does it require 10TB storage as well ?

    2) If we use multiple Data Gateway is 16GB is minimum requirement regardless the EPS  and if we only collect Events. 

    3) Has anyone deployed 10 Data Gateway and managed successfully on Cloud ? As per document IBM can only support upto 10 hence does anyone utilized the maximum ?



    ------------------------------
    K Krish
    ------------------------------


  • 2.  RE: QROC Data Gateway

    Posted 03/09/20 06:39 AM
    Hi K Krish,

    1) That 10TB would be storage for the Event Processor in the cloud environment.  That is managed by our DevOps team.  The Data Gateway (DG) does not require that level of storage.  In our sizing we recommend a minimum of 500GB and a recommended amount of 2TB for the DG.  The only time data will be stored on the DG is when, due to network outage or some other failure, the DG cannot communicate to the QRadar on Cloud processor.  In that situation the data will be housed on the DG until the connection is restored and then the DG will send the data on the the QRadar on Cloud instance.    So, unless you expect long network outages or perhaps have connectivity that is not reliable the recommendation of 2TB should be sufficient.

    2) 16GB is the minimum memory requirement regardless of number of EPS.   That is sufficient for all the services the DG needs to run.  The main variable when raising or lowering the EPS is number of cores as that directly relates to the ability to process the events and/or flows sent to the DG.

    3) We do have customers running more than 10 Data Gateways.  If your deployment requires more than the standard 10 Data Gateways your sales team will work with Offering Management and our DevOps team appropriately size and on board the number of Data Gateways required.

    Hope this info help!

    Jerry Frady

    ------------------------------
    JERRY FRADY
    ------------------------------



Related Content