It all comes down to event volume and there are so many variables that come in to play:
1) How verbose are your audit settings for windows event logs 2) Are you monitoring any local log files? (IIS, other application logs) 3) Are you running syscheck? 4) Are you monitoring any additional directories with syscheck? 5) Are you running a lot of custom rules? etc. . . This is somewhat dated but gives you something to start with: http://www.ossec.net/dcid/?p=69 As you can see you really want to break it down to events per second. Your best bet would be to just grab any old box as the server and install some test agents on various server classes and then determine an approximate number of events. From that you should be able to get a rough overall estimate of events per second. Personally my server has the following specs: Intel dual-core at 2.66 GHz 2 GB RAM Single 250GB drive This was just a basic dell config at the time without anything special. I only have 22 windows agents which have a default config plus monitoring of all my IIS logs. With that config I max out at just under 100 events per second and 3,000,000 events per day with over 99% of those events being IIS log lines. This has no noticeable load on the server (ossec-remoted sits around 1-3% CPU and 0.1% MEM). Hope that helps, cnk On Tue, Aug 19, 2008 at 8:47 AM, Roch <[EMAIL PROTECTED]> wrote: > > Hi what hardware specs is everyone running on? I am trying to spec a > server to scale to 160 windows server agents. Would be useful to get > real world examples of what everyone is running. Thanks. Roch > > -- > Sent from Gmail for mobile | mobile.google.com >
