- CheckMates
- :
- Products
- :
- Quantum
- :
- Management
- :
- Bandwidth utilization report based on source or de...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page
Are you a member of CheckMates?
×- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Bandwidth utilization report based on source or destination
Hi Expert,
One of my customer is trying to generate the report of bandwidth utilization based on Source, Destination and for that they have to enable accounting for the required rules. Now if they enable the account the accounting logs in each rule then how much load be increased on gateway and management/log server. They have separate dedicated log & Event server and currently have 10GB logs per day from 3 clusters. How much CPU, Memory and Storage needs to be increase on Mgmt & log server? They have mix of 13500/13800, 23900 & 41K/44K clusters and those are 20%-30% utilized in peak load.
- Labels:
-
Monitoring
-
SmartEvent
- Tags:
- gateway
Accepted Solutions
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Since you're asking about impact on the log server, please share the disk, memory and CPU usage on that server.
If you have headroom on the log server, it should be OK with adding Accounting. However, if you're already near maxing out, then doubling the amount of logs for those rules may have impact.
Accounting logs are pretty small, but so are FW logs. If those are the majority of your logs, and the relevant rules generate most of the 10GB, then the disk requirements may need to nearly double as well.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If you were to enable Accounting for all rules in the policy, expect roughly a doubling of log events being sent to the SMS/log server by the gateway(s). In addition to the standard logging at the start of the connection, use of Accounting adds an extra consolidated log event when the connection ends, or every 10 minutes if the connection lasts that long.
now available at maxpowerfirewalls.com
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Right using Accounting does not affect the eligibility for accelerating traffic on the gateway, but my take on the question was that it was more about the logging load increase on the SMS/log server.
now available at maxpowerfirewalls.com
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks for your inputs, one last query - does it impact log server storage, if yes how much storage do we need to increase (if customer have 10GB logs per day without smart event.)
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Since you're asking about impact on the log server, please share the disk, memory and CPU usage on that server.
If you have headroom on the log server, it should be OK with adding Accounting. However, if you're already near maxing out, then doubling the amount of logs for those rules may have impact.
Accounting logs are pretty small, but so are FW logs. If those are the majority of your logs, and the relevant rules generate most of the 10GB, then the disk requirements may need to nearly double as well.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
BTW, if you're using R80.10 and above, you can do something really nice with layers.
If you create an ordered layer and place it at the end (bottom), then all traffic that passes the previous layers will go through it as well. In order to be accepted, traffic must be accepted by all layers, so put a cleanup rule for Any-Any-Accept, Track=None. This will ensure that the layer doesn't change the traffic handling.
Now you can add rules above the cleanup for the specific traffic you want to log with accounting. For example: Source=my_network, Destination=dest_network,Accept, Track=Log+Accounting.
Any traffic between that source and destination will add accounting information to the logs. This way you don't need to "hunt down" the relevant rules in your big policy. Also, if you only need accounting on some sub network (that is smaller than the scope of the rule), then this way the accounting will be added more granularly.
You can also use this method to add Detailed or Extended logging on certain traffic. You can even add Alerts on certain suspicious traffic that you aren't sure you want to block.