Endpoint Protection

 View Only

  • 1.  Calculate Events Per Second to send logs to ArcSight

    Posted Oct 29, 2015 11:18 AM

    How can I calculate EPS on a win7 client running Endpoint Protection to estimate the space needed to send logs to ArcSight? Are there any symantec articles that discuss this?



  • 2.  RE: Calculate Events Per Second to send logs to ArcSight
    Best Answer

    Posted Oct 29, 2015 11:23 AM

    There isn't anything specific, no. It all comes down to how many clients and what all events you're currently logging.

    This is the only one I've found but may only somewhat useful:

    Managing log data in the Symantec Endpoint Protection Manager (SEPM)

    Speaking from experience managing a 10k client base, my SIM was collecting roughly 100 EPS.



  • 3.  RE: Calculate Events Per Second to send logs to ArcSight

    Posted Oct 29, 2015 02:09 PM

    Check pages 17 and 18 of the "SEP Sizing and Scalability" document at the following link. Hope that might be of some help.

    http://www.symantec.com/docs/DOC4448

    https://symwisedownload.symantec.com/resources/sites/SYMWISE/content/live/DOCUMENTATION/4000/DOC4448/en_US/SizingSizabilityBestPractices_SEP12.1.5.pdf?__gda__=1446285476_8d7558d6b7adbee1d1299450764fac68