2 Replies Latest reply on Feb 10, 2016 6:04 AM by peter.mason

    Ratio of Sensors to Managers

    peter.mason

      Hi All,

       

      I'd like to find out what ratio of sensors to managers other users have in their environments?

       

      The NSP Installation Guide provides the following details;

       

      "to manage 40 or more McAfee® Network Security Sensors (Sensors), we recommend larger configurations than the minimum-required specifications mentioned in Server requirements."

       

      The documentation does not differentiate between the models of sensors, so you could have 40 M-1250 sensors with a combined throughput of 4GB, or you could have 40 NS9300 sensors with a combined throughput of 1.6 TB and all of the associated data generated.

       

      Has anyone been able to determine how many sensors of which models can be attached to one manager?

       

      Regards

       

      Peter

        • 1. Re: Ratio of Sensors to Managers
          jvdavis456

          Peter,

          The limits I have seen had more to do with the alerts/second generated from the sensors than the number of sensors or models themselves. I have seen deployments of 50+ per manager with well tuned policies and moderate throughput and deployments that couldn't handle more than 10 per manager.

           

          McAfee used to prescribe no more than 50 per NSM, but that was pre-8.1.

          • 2. Re: Ratio of Sensors to Managers
            peter.mason

            Hi jvdavis456,

             

            Yes the limit does appear to depend on the volume of alerts generated by the sensors. The 8.2 best practices guide lists this limit as "1500 alerts per minute from all the Sensors configured to it" which works out as 25 alerts / second, which is very low for the high end model sensors.

             

            Regards

             

            Peter