> Source: [sk181782](https://support.checkpoint.com/results/sk/sk181782) # sk181782 - Security Management Sizing | Property | Value | |----------|-------| | Solution ID | sk181782 | | Date Created | 2024-01-08 | | Last Modified | 2025-01-11 | | Technical Level | General | | Products | Security Management Server | | Versions | R82, R81.20, R81.10 (EOS) | | OS | Gaia | ## Solution This article outlines the steps to size a security management server and validate an existing environment's sizing. Data required for accurate sizing --------------------------------- * Number of Security Gateways * Sustained logs per second * Storage requirements * Multi-Domain/Large-scale deployments * Number of Domains * Size of the rule base * Number of concurrent administrators * Security Management Limitations Collecting the required information ----------------------------------- ### Number of Security Gateways to manage The total number of Security Gateways should be known when sizing a management solution. ### Sustained logs per second To calculate the sustained logs per second, run the doctor log tool on the Security Management Server ``` [Expert@HostName:0]# $RTDIR/scripts/doctor-log.sh ``` 1. Transfer the HTML report (**`/tmp/sme-diag/results/detailed_diag_report.html`**) to the local machine and open it 2. Find the Sustained logs per second * Find "Current Logging Rates" and note "Logging Rate/sec" * Find "Daily Average Logging Rates" and note "Yesterday Avg Logs/sec" 3. Note the larger of the two values. 4. If the values were collected from a server running during a security checkup, please see below to estimate logging rate in a production environment. **Note** : you can also review the output locally with the CLI in the file: **/tmp/sme-diag/results/detailed_diag_report.txt**. #### Security Checkup When capturing data during a security checkup, it is important to note the logs generated do not include firewall logs. Threat Prevention, Application Control, and URL Filtering are estimated to be 2-10% of the total logs for a customer. Therefore, divide the Sustained logs per second by 0.06 (6%) to obtain the total sustained logs per second, including firewall logs. **Note** : 6% is the median for 2-10%. ##### Example **`150 � 0.06 = 2500 sustained logs per second.`** #### Peak logs per second Although not used in the sizing calculation, the peak logs per second can help identify undersized environments. The max peak logs per second can be compared to the Smart-1 appliance numbers in [sk112797](https://support.checkpoint.com/results/sk/sk112797) ``` [Expert@HostName:0]# cpstat mg -f log_server Log Receive Rate: � � � � � � � � 1 Log Receive Rate Peak: 9 Log Receive Rate Last 10 Minutes: 0 Log Receive Rate Last Hour: � � � 0 ``` ### Storage requirements Using the sustained logs per second, estimate the expected log volume per day. Then, use the expected log volume per day to calculate the disk space needed for the customer's retention requirements. The average log size is **\~150 bytes** in size. Use this information to perform the following calculation **(Sustained logs per second) x (Seconds per working day) x (Log entry size) � 1024 � 1024 � 1024 = Log storage in GB per da** `y` **Note** : We use the Logging Rate/sec value to calculate the sustained logs per second. We assume the server will receive this number of sustained logs per second for a certain number of hours during a workday. In this example, we estimate a 12-hour workday, but you may need to adjust this period based on your scenario. Log files and log index are the same size (log indexing has a 1:1 ratio). The default retention period for indexing is 14 days. However, the retention period can be changed. Then, calculate the disk size required for the customer's specified retention period. **Log storage in GB per day x Retention period = Storage required for log retention (GB)** #### Example calculation: * 2500 logs per second * 90-day retention period * 14 days for indexes to be kept **`2500 x 43200 x 150 � 1024 � 1024 � 1024 = 16 GB` `(~16 GB x 90 days) + (16 GB x 14) = 1664 GB required`** ### Multi-Domain/Large-scale deployments For Multi-Domain/Large-scale deployments, refer to [sk178325 - Sizing Recommendations for Check Point Management Server](https://support.checkpoint.com/results/sk/sk178325). Suggesting the correct Smart-1 appliance ---------------------------------------- Compare the data collected with the [Smart-1 Datasheet](https://www.checkpoint.com/downloads/products/smart-1-security-management-platform-datasheet.pdf) numbers. ### Always recommend * Dedicated log server * Management High Availability * Standby management servers can be used as log servers ### SmartEvent * Recommend dedicated log and SmartEvent servers * SmartEvent must always be on the primary management server or dedicated server * [sk25164 - SmartEvent Software Blade in Management High Availability environment](https://support.checkpoint.com/results/sk/sk25164) ### Example #### Collected data * 10 Security Gateways * 2500 sustained logs per second * 90-day retention = 1664 GB storage required * SmartEvent Required #### Recommendation * Smart-1 600-S appliance for management primary * Smart-1 600-S appliance for management secondary + backup log server * Smart-1 600-M appliance for SmartEvent server + primary log server ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk181782/Check Point Smart-1 Security Management Platform Datasheet202312211616461.png) The above calculations should be used as a starting point. When more resources are needed, additional log servers can be added, and logs can be distributed over the log servers dynamically using [Dynamic Log Distribution](https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_LoggingAndMonitoring_AdminGuide/Content/Topics-LMG/Understanding-Logging.htm#DynamicLogDistribution). --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content