Calculations for the Sandbox component
The hardware requirements for a server with the Sandbox component depend on the type and volume of processed traffic and on the permissible object scan time.
By default, the permissible object scan time is 1 hour. To reduce this time, you need a more powerful server or more servers with the Sandbox component.
It is recommended to calculate the configuration of the Sandbox component as follows:
- Install the Central Node and Sensor components on one server and the Sandbox component on a different server for pilot operation of the program.
To receive sufficient statistical data, the program must process traffic of the organization for a week.
- Run the data recording script by executing the following commands:
kata-collect --output-dir path-to-folder--output-dir <path to directory>When the script finishes running, the collect.tar.gz archive will be moved to the specified directory.
- Forward this archive to Kaspersky Lab staff for analysis.
If multiple virtual machines are started simultaneously, the speed of processing objects from the queue is increased.
Hardware requirements for the server hosting the Sandbox component
The calculation of the number of servers with the Sandbox component depending on the load is shown in the table below.
Hardware requirements of the Sandbox component depending on the volume of processed traffic
Maximum number of email messages per second |
Maximum volume of traffic from SPAN ports (Mbps) |
Maximum number of Kaspersky Endpoint Agent for Windows computers |
Number of physical servers with the Sandbox component |
|
|---|---|---|---|---|
When using three |
When using three |
|||
1 |
200 |
1000 |
1 |
1 |
2 |
500 |
3000 |
1 |
1 |
1 |
1000 |
5000 |
1 |
1 |
5 |
2000 |
5000 |
1 |
1 |
20 |
4000 |
10000 |
2 |
3 |
The estimation of the number of Sandbox components is listed for servers with the following configuration:
- When installing the Sandbox component on a physical server:
- 2 Intel Xeon 8 Core (HT) CPUs
- 80 GB of RAM
- 2 HDDs, 300 GB each
- When installing the Sandbox component on a VMware ESXi virtual machine:
- Intel Xeon 15 Core (HT) processor at 2.1 GHz or higher
- 32 GB of RAM
- 300 GB HDD
On the virtual machine:
- Nested virtualization enabled.
- Latency Sensitivity option set to High.
- Entire RAM is reserved.
- Entire CPU frequency is reserved.
When installing the Sandbox component on a VMware ESXi virtual machine, you must set the limit for simultaneously running virtual machines to 12.
The performance of 3 or 4 virtual machines of the Sandbox component is identical to one Sandbox component on a physical server.