> Source: [sk87263](https://support.checkpoint.com/results/sk/sk87263) # sk87263 - SmartEvent Sizing Guide for Smart-1 appliance that run R77.x / R80 / R80.10 / R80.20 / R80.30 versions | Property | Value | |----------|-------| | Solution ID | sk87263 | | Date Created | 2012-11-06 | | Last Modified | 2025-04-11 | | Technical Level | General | | Products | Security Management Server | | Versions | R82.10, R82, R81.20, R82.x, R82.20 | | OS | Gaia | | Platform | Smart-1 | ## Solution **This Sizing Guide refers to Smart-1 appliances with enabled SmartEvent that run the R77.x / R80 / R80.10 / R80.20 / R80.30 versions.** * For SmartEvent NGSE, refer to: * [sk98767 - SmartEvent NGSE](https://support.checkpoint.com/results/sk/sk98767). * For Smart-1 Appliances, refer to: * [sk112797 - Smart-1 R80.x Logging Capacity Performance Improvements](https://support.checkpoint.com/results/sk/sk112797) * [sk112797 - Smart-1 Appliances Logging Capacity Performance](https://support.checkpoint.com/results/sk/sk112797) * [sk178325 - Sizing Recommendations for Check Point Management Serves](https://support.checkpoint.com/results/sk/sk178325) **Procedure:** To find the suitable Smart-1 appliance for SmartEvent Server, get the log scale estimations for your environment by running the **CPLogInvestigator** Sizing Tool on the Management Server / Log Server, to which the managed Security Gateways send their traffic logs. 1. For a Log Server that runs an R77.30 / R77.20 / R77.10 / R77 version, install the tool. Show / Hide this section 1. Download the [CPLogInvestigator.tgz](https://support.checkpoint.com/results/download/23386) package to your computer. 2. Copy this TGZ package from your computer to the Management / Log Sever to some directory (for example, `/var/log/`). 3. Connect to the command line on the Management Server / Log Server. 4. Log in to the Expert mode. 5. Create a new directory for this tool: `mkdir -v $FWDIR/bin/CPLogInvestigator` 6. Copy the TGZ package to the new directory: `mv -v /var/log/CPLogInvestigator.tgz $FWDIR/bin/CPLogInvestigator` 7. Go to the new directory: `cd $FWDIR/bin/CPLogInvestigator` 8. Extract the TGZ package: `gtar -zxvf CPLogInvestigator.tgz` 9. Assign the required permissions: `chmod -v 777 *` 2. Run the CPLogInvestigator tool with these arguments: `CPLogInvestigator -a -p > /var/log/CPLogInvestigator.txt` Note - Default analysis duration is 60 seconds. > The syntax: > > `CPLogInvestigator [-h] [-a] [-l] [-m] [-p] [-u ] [{-i | -f }]` > > Where: > > |--------------|---------------------------------------------------------------------------------------------------------------------------| > | Parameter | Description | > | `-h` | Shows this built-in help. | > | No Arguments | Scan all '`*.log`' files in the folder `$FWDIR/log/`. Default analysis duration is 60 seconds. | > | `-a` | Scan all '`*.log`' files. If you do not specify '`-f`' or '`-i`', it scans `$FWDIR/log/`. | > | `-i` | Scans the specified log file. Must be the last parameter in the syntax. | > | `-f` | Scans all '`*.log`' files in the specified folder. Must be the last parameter in the syntax. | > | `-l` | Limits the analysis duration 60 seconds. | > | `-m` | Saves the number of logs per minute in the file '`logPerMinute.txt`'. | > | `-p` | Shows the daily log count for Software Blades. | > | `-u` | Specifies the number of required users for the estimations for the Application Control and URL Filtering Software Blades. | 3. Compare the summary in the output file `/var/log/CPLogInvestigator.txt` with the summary table below. This is the supported scale for Smart-1 appliances that run the SmartEvent R77.x / R80 / R80.10 / R80.20 / R80.30 versions: |----------------------------------------------|--------------------------|---------------------------|---------------------------------| | | **Smart-1 5 SmartEvent** | **Smart-1 25 SmartEvent** | **Smart-1 50 / 150 SmartEvent** | | Logs analyzed per day (total file size) | 2 GB | 10 GB | 25 GB | | Maximum events per day ^(1)^ | 250,000 | 500,000 | 1,000,000 - 5,000,000 ^(2)^ | | Supported users ^(1)^ | 900 | 3,000 | 7,000 - 80,000 ^(2)^ | | Available storage for historic records ^(3)^ | 315 GB | 720 GB | 1,200 GB | Notes: 1. Enabling SmartReporter on the Smart-1 appliance would reduce the supported scale by 50%. Read [sk80720](https://support.checkpoint.com/results/sk/sk80720) for advanced tuning suggestions to maximize performance. 2. The upper limit can be reached by extending RAM to 16 GB (when supported): * If the Application Control and URL Filtering Software Blades **are** activated on the managed Security Gateways, then 20,000 users are supported. * If the Application Control and URL Filtering Software Blades are **not** activated on the managed Security Gateways, then 80,000 users are supported. 3. To evaluate the number of historic days to keep, divide the available storage by the estimated daily consumption reported by the CPLogInvestigator Sizing Tool. --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content