First, let me say that there are MANY variables to consider:

1) How long you are retaining log data/quantity

2) How many client versions you are storing

3) How much content data you are storing

4) Backup data

5) Package data

...

etc.

 

Here's a basic example for sizing (will vary depending on your settings/requirements).  I would suggest working with a Symantec rep in order to provide more specific numbers, so please consider this a starting point and NOT a recommendation.

The scenario below gives an example of the space required for Symantec Endpoint Protection implementation with 17,000 nodes.  This example assumes the following metrics:

•         An average 15,000 viruses over 60 days

•         Keeping 20,000 Events of each Log

•         Keeping 5 Versions of each SEP client ( 32/64 Bit, English and French language)

•         7 Backups are being retained

 

ITEM                                                                            SPACE REQUIRED

15,000 Viruses Detected/Quarantined                         12.9 MB

20,000 Events per log                                                     722 MB

20 Client Versions                                                          1280 MB

(5*2*2 (5 clients*2 (32 and 64bit) *2 (english and french))

Content Updates                                                            300 MB

 

Total Database size: 3.2GB*

* - the database size of 2.3GB must be multiplied by 1.4 to account for the overhead of indexes and other tables in the DB. 

The space required on the SEPM server to store 7 backups is approximately 14.5GB. A key component of the SEPM server is Internet Information Server (IIS) content which equals approximately 4GB.

I would suggest a minimum size of 25-50GB for the database to be safe.  You can set the thresholds for log data, # of client versions, etc. in the SEPM.

On the Manager, you will need at least 15GB - content will take ~2GB for 10 update iterations retained (default) and then you will need additional space for temp storage, packages, IIS (4GB), etc. 

Again, all these numbers will vary depending on the thresholds set and requirements you have,

 

Thanks for the response. 

 

I do realize there are many variables to consider.  I saw the document that you pulled this info from, and that's why I'm concerned. 

 

We have 50 computers in a test bed, keeping 10k events per log, less than 100 viruses over 45 days, 4 client versions TOTAL (2 32-bit, 2 64-bit), 0 backups.  My database is now over 5 GB. 

 

Eventually I will have 5000-7000 computers, and I'm trying to determine whether the database will grow based on the number of computers managed, and how much. 

Well, there are threshold settings in the system for log and report data - this is how you can keep the space in check.  From my experience, there is an inital surge of space required in the DB for content, packages, etc. but it will level off.  Set your thresholds for quantity and time to retain data, and you should be under the 10GB size for 5000 clients.  I always use the "doubling" rule of thumb just to be safe. 

OWN3D,

On post SQL Server Database Sizing you wrote "I would suggest working with a Symantec rep in order to provide more specific numbers, so please consider this a starting point and NOT a recommendation."

 

can you give me some pointer on how to get a hold of my "symantec rep", My boss brought/renewed license through the web... and I just can't wait to squeeze it out from him.  Is there a general phone # or ... to find my rep.  I do have the serial # that I use to download SEP.

 

 

Thanks in Advance.

 

Also good thing to do is set the database growth to about 100 meg or more.

 

This has helped with performance with every growth that has happened on my other data bases. One app was making 1 meg growth every 30 min and next day it was compressed back like a rubber band, all we were doing is adding more disk usage every 30 min only to compress it back again. Now we compress once a week and no more delays during database expansion.

your "Symantec rep" is in most cases going to be an SE of some sort.  If the only contact you have with us is through a partner or similar then its harder.  The partner *should* be able to get hold of most information or find people internally who can help with things like this.

 

If you aren't getting anywhere though, feel free to PM me and I'll try and help out.

 

For sizing, I would ask the following questions:

 

1. How many days history per log type do you want to keep (there is no point in keeping some of these for more than a couple of days)

2. What protection technologies have you deployed

3. What sort of log volumes per log are you seeing (are you logging every single firewall events for example?)

4. Are you forwarding all logs from the client to the manager, or just certain types?

5. How many clients (naturally!)

6. Number of SEPM's in your site

7. Number of Admin accounts in your site

8. Number of SEP client packages

9. Number of Content packages you wish to keep (default is 10, but we all know the problems)

10. Number of database backups you want

11. Number of virus scans per day/week/month (whichever is more appropriate)

12. Number of times per day your clients will update content

13. Client Heartbeat interval

 

Give me those and with some small assumptions we should be able to get a reasonably accurate number