Video Screencast Help

SQL Server Database Sizing

Created: 09 Jan 2008 • Updated: 21 May 2010 | 8 comments
I'm trying to scope out a server for putting SEP 11 into our production environment.  Does anyone know where I can find information on sizing disk space for SQL Server?  I'd like to get a ballpark on how large my database will grow as we begin to add computers. 
At this point, we have a 5 GB database for 50 machines after 45 days.  I really hope the database for 5000 machine isn't 500GB, but I think that's what I might be looking at.
Any ideas?

Comments 8 CommentsJump to latest comment

0WN3D's picture
First, let me say that there are MANY variables to consider:
1) How long you are retaining log data/quantity
2) How many client versions you are storing
3) How much content data you are storing
4) Backup data
5) Package data

Here's a basic example for sizing (will vary depending on your settings/requirements).  I would suggest working with a Symantec rep in order to provide more specific numbers, so please consider this a starting point and NOT a recommendation.

The scenario below gives an example of the space required for Symantec Endpoint Protection implementation with 17,000 nodes.  This example assumes the following metrics:

         An average 15,000 viruses over 60 days

         Keeping 20,000 Events of each Log

         Keeping 5 Versions of each SEP client ( 32/64 Bit, English and French language)

         7 Backups are being retained


ITEM                                                                            SPACE REQUIRED

15,000 Viruses Detected/Quarantined                         12.9 MB

20,000 Events per log                                                     722 MB

20 Client Versions                                                          1280 MB

(5*2*2 (5 clients*2 (32 and 64bit) *2 (english and french))

Content Updates                                                            300 MB


Total Database size: 3.2GB*

* - the database size of 2.3GB must be multiplied by 1.4 to account for the overhead of indexes and other tables in the DB. 

The space required on the SEPM server to store 7 backups is approximately 14.5GB. A key component of the SEPM server is Internet Information Server (IIS) content which equals approximately 4GB.

I would suggest a minimum size of 25-50GB for the database to be safe.  You can set the thresholds for log data, # of client versions, etc. in the SEPM.

On the Manager, you will need at least 15GB - content will take ~2GB for 10 update iterations retained (default) and then you will need additional space for temp storage, packages, IIS (4GB), etc. 

Again, all these numbers will vary depending on the thresholds set and requirements you have,


Message Edited by 0WN3D on 01-09-2008 02:29 PM

SHellmueller's picture
Thanks for the response. 
I do realize there are many variables to consider.  I saw the document that you pulled this info from, and that's why I'm concerned. 
We have 50 computers in a test bed, keeping 10k events per log, less than 100 viruses over 45 days, 4 client versions TOTAL (2 32-bit, 2 64-bit), 0 backups.  My database is now over 5 GB. 
Eventually I will have 5000-7000 computers, and I'm trying to determine whether the database will grow based on the number of computers managed, and how much. 
0WN3D's picture
Well, there are threshold settings in the system for log and report data - this is how you can keep the space in check.  From my experience, there is an inital surge of space required in the DB for content, packages, etc. but it will level off.  Set your thresholds for quantity and time to retain data, and you should be under the 10GB size for 5000 clients.  I always use the "doubling" rule of thumb just to be safe. 
Jonabc123's picture
On post SQL Server Database Sizing you wrote "I would suggest working with a Symantec rep in order to provide more specific numbers, so please consider this a starting point and NOT a recommendation."
can you give me some pointer on how to get a hold of my "symantec rep", My boss brought/renewed license through the web... and I just can't wait to squeeze it out from him.  Is there a general phone # or ... to find my rep.  I do have the serial # that I use to download SEP.
Thanks in Advance.
Knottyropes's picture
Also good thing to do is set the database growth to about 100 meg or more.
This has helped with performance with every growth that has happened on my other data bases. One app was making 1 meg growth every 30 min and next day it was compressed back like a rubber band, all we were doing is adding more disk usage every 30 min only to compress it back again. Now we compress once a week and no more delays during database expansion.
Paul Murgatroyd's picture
your "Symantec rep" is in most cases going to be an SE of some sort.  If the only contact you have with us is through a partner or similar then its harder.  The partner *should* be able to get hold of most information or find people internally who can help with things like this.
If you aren't getting anywhere though, feel free to PM me and I'll try and help out.
For sizing, I would ask the following questions:
1. How many days history per log type do you want to keep (there is no point in keeping some of these for more than a couple of days)
2. What protection technologies have you deployed
3. What sort of log volumes per log are you seeing (are you logging every single firewall events for example?)
4. Are you forwarding all logs from the client to the manager, or just certain types?
5. How many clients (naturally!)
6. Number of SEPM's in your site
7. Number of Admin accounts in your site
8. Number of SEP client packages
9. Number of Content packages you wish to keep (default is 10, but we all know the problems)
10. Number of database backups you want
11. Number of virus scans per day/week/month (whichever is more appropriate)
12. Number of times per day your clients will update content
13. Client Heartbeat interval
Give me those and with some small assumptions we should be able to get a reasonably accurate number

Paul Murgatroyd
Principal Product Manager, Symantec Endpoint Protection
Endpoint twitter feed:

StevoFromAg's picture

Hi Paul

I'm a DBA and we're soon to implement a version of Endpoint Protection. I just came across this post and was wondering if I sent you the answers to these question I got from our anti-virus administrator could you please give me some indication as to what kind of sizing requirements we'd need from a database perspective?

Many thanks


Paul Murgatroyd's picture
yes, I can take a look

Paul Murgatroyd
Principal Product Manager, Symantec Endpoint Protection
Endpoint twitter feed: