Component requirements

[Ryan Felim]

Hello Community,

I am trying to setup wazuh using the separated installation method. Is there a more detailed reference for me to count my required components? There is a reference in the wazuh documentation in the wazuh server section. The table information stated that 4GB RAM and 8 CPU Cores is the recommended hardware components. But, there is no information on how many agents can a (4 GB RAM and 8 CPU Cores) wazuh server can manage or handle.

There is an information on each server, workstation, and network devices if each endpoint have certain APS will require how much storage for 90 days. But, APS and EPS are two different variables right? Alert is an event that trigger the wazuh ruleset right? Is there a way for me to count EPS from APS? Cam I get a more detailed reference for me to count my required component more accurately? It is also possible, that I don't know how to count the required components from the source that wazuh prepared for. 

Please help me solve this issue.
Thank you.

[Manuel Jose Cano Rojo]

Hello Ryan Felim,

This is not the exact case you are talking about, but we can use it as a reference. This link refers to the requirements for an all-in-one deployment.
As you can see, the entire wazuh stack, meaning wazuh manager, dashboard, and indexer in a single machine, can manage up to 100 agents with no problems, having 8 cores and 8GB RAM.

The number of EPS and APS will mainly depend on your own wazuh setting, the different scan frequencies, the active modules, the FIM setup... and the reported activity of each agent itself, so it's not easily predictable. You can consult this reference in order to check if the environment is working properly and if your hardware is sufficient.

Hope this help you, anything else, feel free to ask!

Regards,

Manuel.

[Ryan Felim]

Hello Mauel,

Yes thankyou, I believe the hardware requirement will require further testing to actually know the details. I will use every wazuh sources as a reference. 

Thank you.

[Peter Santiago]

Just to clarify. The specs mentioned here are only applicable when dealing only with agents and no other inputs..is that correct?

--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/27b7e5a0-80ee-42b6-a234-517a1b9fc343n%40googlegroups.com.

[Ryan Felim]

Correct. Just agents, but each endpoint produce differents EPS. For example agent 1 and 2 has 300 eps  and agent 3, 4, and 5 produce 600-700 EPS. Will that be enough, for 8 cores and 8GB RAM wazuh manager? Is it enough, or overworked, or plenty of agent are still available to manage. I have discussed this topic and turns out I have to test it for myself because there are lots of more variable need to be considered for accurate calculation. 

Thank you