Showing results for 
Search instead for 
Did you mean: 

DAS Installation

Hi Team,

We have 1 DAS (direct attached storage) but we are not sure to which device (ESM or ELM) it should connect while doing DAS installation, kindly suggest



1 Reply
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 2 of 2

Re: DAS Installation

If someone bought a DAS, they probably had some idea which device they were going to connect it to so I would go ask them or your account team. That being said:

It can be attached to either depending upon your retention requirements. The solution maintains holds two copies of the data. The raw logs and the metadata based on those logs.

The raw logs are digitally signed and archived on the ELM in a time-based retention pool. Best practice is to use external storage for the ELM (SAN), but is DAS is going to provide better performance. You would need to calculate rate of your events and vs. your required retention time to know if you have enough storage. The default compression ratio is 14:1.

For the ESM, the metadata is stored and retained on the local storage + DAS (if there is one). Again, the rate of logs can be calculated against the metadata storage to understand if you have the amount of retention you need. One approximate benchmark is a billion records per terabyte but this is heavily dependent on your aggregation ratio that your events are able to be summarized by.