Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Mahipal_Singh
Employee
Employee
Jump to solution

Bandwidth utilization report based on source or destination

Hi Expert,

One of my customer is trying to generate the report of bandwidth utilization based on Source, Destination and for that they have to enable accounting for the required rules. Now if they enable the account the accounting logs in each rule then how much load be increased on gateway and management/log server. They have separate dedicated log & Event server and currently have 10GB logs per day from 3 clusters. How much CPU, Memory and Storage needs to be increase on Mgmt & log server? They have mix of 13500/13800, 23900 & 41K/44K clusters and those are 20%-30% utilized in peak load.

   

0 Kudos
1 Solution

Accepted Solutions
Tomer_Noy
Employee
Employee

Since you're asking about impact on the log server, please share the disk, memory and CPU usage on that server.

If you have headroom on the log server, it should be OK with adding Accounting. However, if you're already near maxing out, then doubling the amount of logs for those rules may have impact.

Accounting logs are pretty small, but so are FW logs. If those are the majority of your logs, and the relevant rules generate most of the 10GB, then the disk requirements may need to nearly double as well.

View solution in original post

0 Kudos
6 Replies
Timothy_Hall
Legend Legend
Legend

If you were to enable Accounting for all rules in the policy, expect roughly a doubling of log events being sent to the SMS/log server by the gateway(s).  In addition to the standard logging at the start of the connection, use of Accounting adds an extra consolidated log event when the connection ends, or every 10 minutes if the connection lasts that long.

Gateway Performance Optimization R81.20 Course
now available at maxpowerfirewalls.com
0 Kudos
PhoneBoy
Admin
Admin
I don't believe this will increase the usage of any of the above substantially as accounting data is largely tracked by SecureXL.
0 Kudos
Timothy_Hall
Legend Legend
Legend

Right using Accounting does not affect the eligibility for accelerating traffic on the gateway, but my take on the question was that it was more about the logging load increase on the SMS/log server.

Gateway Performance Optimization R81.20 Course
now available at maxpowerfirewalls.com
Mahipal_Singh
Employee
Employee

Thanks for your inputs, one last query - does it impact log server storage, if yes how much storage do we need to increase (if customer have 10GB logs per day without smart event.)

0 Kudos
Tomer_Noy
Employee
Employee

Since you're asking about impact on the log server, please share the disk, memory and CPU usage on that server.

If you have headroom on the log server, it should be OK with adding Accounting. However, if you're already near maxing out, then doubling the amount of logs for those rules may have impact.

Accounting logs are pretty small, but so are FW logs. If those are the majority of your logs, and the relevant rules generate most of the 10GB, then the disk requirements may need to nearly double as well.

0 Kudos
Tomer_Noy
Employee
Employee

BTW, if you're using R80.10 and above, you can do something really nice with layers.

If you create an ordered layer and place it at the end (bottom), then all traffic that passes the previous layers will go through it as well. In order to be accepted, traffic must be accepted by all layers, so put a cleanup rule for Any-Any-Accept, Track=None. This will ensure that the layer doesn't change the traffic handling.

Now you can add rules above the cleanup for the specific traffic you want to log with accounting. For example: Source=my_network, Destination=dest_network,Accept, Track=Log+Accounting.

Any traffic between that source and destination will add accounting information to the logs. This way you don't need to "hunt down" the relevant rules in your big policy. Also, if you only need accounting on some sub network (that is smaller than the scope of the rule), then this way the accounting will be added more granularly.

You can also use this method to add Detailed or Extended logging on certain traffic. You can even add Alerts on certain suspicious traffic that you aren't sure you want to block.

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events