Hardware Requirements

Hardware Requirements Guide

Note: The actual hardware requirements are site specific and depend on the amount and size of event collection required, the topology of the network and failover requirements.

Sizing

Sizing is situationally dependent and should be tested and adapted for the workload to determine actual requirements. The following sizing is provided as guidance for provisioning a HyperSec HyperCollector.

Estimations

The following is provided as guidance for estimating resource requirements. They are based on an average workload and will vary depending on actual requirements.

Event Type	Average Event Size	Throughput
Structured log event	~768 bytes	~25 MiB/s/vCPU
Unstructured log event	~256 bytes	~10 MiB/s/vCPU
Metric event	~256 bytes	~25 MiB/s/vCPU

Minimum Recommended Specifications

• 2 vCPUs - x86_64 Architecture

• 2 GiB Memory per vCPU

• 64 GiB Disk Buffer

Event Buffering

A disk-backed buffer is used to provide resilience when the Upstream Sink is unavailable. The disk-backed buffer resides on a separate encrypted partition, ensuring event data spooled on the HyperCollector is protected at rest. The virtual appliance HyperCollector is shipped with a minimal-sized Spool partition, /dev/sdb. This disk should be sized to suit the required spool size for the individual site and will be auto-resized on boot by the HyperCollector.