Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 

System Requirements for Virtual Appliances

 

To ensure that JSA works correctly, you must use virtual appliances that meet the minimum requirements.

For more information about supported hypervisors and virtual hardware versions, see Creating Your Virtual Machine.

Note

The minimum requirements support JSA functionality with minimum data sets and performance. The minimum requirements support a JSA system that uses only the default apps. For optimal performance, use the suggested requirements.

Memory Requirements

The following table describes the memory requirements for virtual appliances.

Table 1: Minimum and Suggested Memory Requirements for JSA Virtual Appliances

Appliance

Minimum memory requirement

Suggested memory requirement

JSA Flow Processor Virtual 1299

6 GB

6 GB

JSA Flow Processor

24 GB

48 GB

JSA Event Collector Virtual 1599

12 GB

16 GB

JSA Event Processor Virtual 1699

up to 20,000 EPS

12 GB

48 GB

JSA Event Processor Virtual 1699

20,000 EPS or higher

128 GB

128 GB

JSA Flow Processor Virtual 1799

up to 1,200,000 FPM

12 GB

48 GB

JSA Flow Processor Virtual 1799

1,200,000 FPM or higher

128 GB

128 GB

JSA Threat Analytics “All-in-one” or Console 3199

5,000 EPS or less

200,000 FPM or less

32 GB

48 GB

JSA Threat Analytics “All-in-one” or Console 3199

30,000 EPS or less

1,000,000 FPM or less

64 GB

128 GB

Virtual JSA Log Manager

24 GB

48 GB

JSA Risk Manager

24 GB

48 GB

JSA Vulnerability Manager Processor

32 GB

32 GB

JSA Vulnerability Manager Scanner

16 GB

16 GB

JSA App Host

12 GB

64 GB or more for a medium sized App Host

128 GB or more for a large sized App Host

Processor requirements

The following table describes the CPU requirements for virtual appliances.

Table 2: CPU Requirements for JSA Virtual Appliances

Appliance

Threshold

Minimum number of CPU cores

Suggested number of CPU cores

JSA Flow Processor 1299

10,000 FPM or less

4

4

JSA Event Collector Virtual 1599

2,500 EPS or less

4

16

5,000 EPS or less

8

16

20,000 EPS or less

16

16

JSA Event Processor Virtual 1699

2,500 EPS or less

4

24

5,000 EPS or less

8

24

20,000 EPS or less

16

24

40,000 EPS or less

40

40

80,000 EPS or less

56

56

JSA Flow Processor Virtual 1799

150,000 FPM or less

4

24

300,000 FPM or less

8

24

1,200,000 FPM or less

16

24

2,400,000 FPM or less

48

48

3,600,000 FPM or less

56

56

JSA Event and Flow Processor Combo

200,000 FPM or less

5,000 EPS or less

16

24

300,000 FPM or less

15,000 EPS or less

48

48

1,200,000 FPM or less

30,000 EPS or less

56

56

JSA Threat Analytics “All-in-one” or Console 3199

25,000 Flows per minute (FPM) or less

500 EPS or less

4

24

50,000 FPM or less

1,000 EPS or less

8

24

100,000 FPM or less

1,000 EPS or less

12

24

200,000 FPM or less

5,000 EPS or less

16

24

300,000 FPM or less

15,000 EPS or less

48

48

1,200,000 FPM or less

30,000 EPS or less

56

56

JSA Virtual Log Manager

2,500 Events per second (EPS) or less

4

16

5,000 EPS or less

8

16

JSA Vulnerability Manager Processor

 

4

4

JSA Vulnerability Manager Scanner

 

4

4

JSA Risk Manager

 

8

8

JSA Flow Processor

4

16

JSA App Host

4

12 or more for a medium sized App Host

24 or more for a large sized App Host

Storage Requirements

Your virtual appliance must have at least 256 GB of storage available. Before you install your virtual appliance, use the following formula to determine your storage needs:

(Number of Days) x (Seconds in a day) x (Events per second rate) x (Average size of a log event x 1.5 JSA normalized event overhead) x 1.05 / (1000 x 1000 x 1000) + 40 GB

The following table shows the storage requirements for installing JSA by using the virtual or software only option.

Table 3: Minimum storage requirements for appliances when you use the virtual installation option.

System classification

Appliance information

IOPS

Data transfer rate (MB/s)

Minimum performance

Supports XX05 licensing

800

500

Medium performance

Supports XX29 licensing

1200

1000

High Performance

Supports XX48 licensing

10,000

2000

Small All-in-One or 1600

Event/Flow Processors

300

300

Event/Flow Processors

Event/Flow Collectors

300

300