Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
ON THIS PAGE
 

Hardware and software requirements for the WinCollect 10 host

Ensure that the Windows-based computer that hosts the WinCollect 10 agent meets the minimum hardware and software requirements.

Hardware and virtual machine requirements

The following table describes the minimum hardware requirements for local collection:

Table 1: Hardware or VM requirements for local collection by using WinCollect:
Requirement Description
Memory

The WinCollect agent has a small memory footprint. The following numbers were generated on virtual machines (VMs) with two logical cores and 2-4GB of memory.

One Event per second (EPS) or less: 3.5 MB

100 EPS or less: 3.6 MB

2,500 EPS or less: 4.6 MB

5,000 EPS or less: 6 MB
Processor Intel Core i3 or equivalent

Systems were tested on VMs with two cores and 2 - 4 GB of memory.
Available processor resources 0-20%, depending on CPU, EPS, and number of endpoints polled. See the following table for examples.

Very high EPS rates have a direct effect on the Average CPU used by the WinCollect Agent.
Disk space

20 MB for software, plus up to 300 MB for log files.

Up to 6 GB might be required, if you store events to disk.
Note:

WinCollect CPU load depends on several factors, including the number of events per second that are being processed.

The following table shows resources that are used by WinCollect 10, using the minimum recommended provisioned test environments with various EPS counts.

Table 2: Local Collection - System, Application, Security event logs
Profile OS CPU Memory Average CPU Memory
Low EPS (<1) Windows 10 2 cores 2 GB 0.0% 2.8 MB
Low EPS (<1) Server 2016 2 cores 4 GB 0.0% 4.1MB
Low EPS (<1) Server 2019 2 cores 4 GB 0.0% 3.5 MB
Medium EPS (100) Windows 10 2 cores 2 GB 0.21% 3.0 MB
Medium EPS (100) Server 2016 2 cores 4 GB 0.12% 4.1 MB
Medium EPS (100) Server 2019 2 cores 4 GB 0.10% 3.6 MB
High EPS (5000) Windows 10 2 cores 2 GB 14% 4.7 MB
High EPS (5000) Server 2016 2 cores 4 GB 8% 6.0 MB
High EPS (5000) Server 2019 2 cores 4 GB 9% 5.7 MB
Table 3: Local Collection - WEF Collector: WinCollect 10 running on a WEF collector can support up to 10k EPS. When collecting events at this high of an EPS, run the Agent on a dedicated host.
Profile OS CPU Memory Average CPU Memory
WEF Collector Server 2019 6 cores 16 GB 4.5% 13 MB
Table 4: Remote Collection:
Note:

WinCollect CPU and memory loads depend on several factors, including the number of events per second that are being processed and the number of remote endpoints that are being polled.
Profile OS CPU Memory EPS Endpoints polled Average CPU Memory

High EPS / Low Device Count

 Server 2019 8 cores 16 GB 5000 10 7.5% 11 MB

High EPS / Medium Device Count

 Server 2019 8 cores 16 GB 5000 250 4.8% 36 MB

High EPS / High Device Count

 Server 2019 8 cores 16 GB 5000 500 7.1% 60 MB

Software requirements

The following table describes the software requirements:

Table 5: Software requirements:

Requirement Description
Operating system

Windows Server 2022 (including Core)

Windows Server 2019 (including Core)

Windows Server 2016 (including Core)

Windows Server 2012 (including Core)

Windows 10
Distribution One WinCollect agent for each Windows host.
Required user role permissions for installation

Administrator, or local administrator
Note:

WinCollect is not supported on versions of Windows that are designated end-of-life by Microsoft. After software is beyond the Extended Support End Date, the product might still function as expected. However, Juniper does not make code or vulnerability fixes to resolve WinCollect issues for older operating systems. For example, Microsoft Windows Server 2003 R2 and Microsoft Windows XP are operating systems that are beyond the "Extended Support End Date." Any questions about this announcement can be discussed in the JSA Collecting Windows Events (WMI/ALE/WinCollect) forum. For more information, see https://support.microsoft.com/en-us/lifecycle/search.