Documentation forSecurity Event Manager

Allocate CPU and memory resources to the SEM VM

By default, SEM deploys with 8GB of RAM and 2 CPUs on the VMware ESX(i) and Microsoft Hyper-V platforms. For SEM to work properly, you must allocate sufficient CPU and memory resources to the SEM VM. This topic describes how to check resource settings and make updates.

See SEM system requirements in the SEM Installation Guide for hardware and software sizing requirements.

As of version 6.3.0, SEM can send SNMP version 3 alerts to SolarWinds Network Performance Manager (NPM). This configuration allows you to monitor CPU, memory, and other critical SEM components from the SolarWinds Orion Web Console.

Security Event Manager collects data from a continuous stream of traffic that fluctuates based on user, server, and network activity. The type and volume of traffic varies based on the device sending the traffic and the audit and log settings on those devices.

About incoming data traffic

Security Event Manager receives data from syslogs and traps using up to 500 connectors that receive data traffic from several supported network devices. These connectors translate (or normalize) the data into a readable and understandable format you can view in the SEM console.

The events appear in the Monitor view, pass through the rules engine for specified actions, and then move into a database for retrieval by the SEM Reports or nDepth search function. To process the data in real time, SEM requires system resource reservations from the virtual appliance host.

When the volume of traffic exceeds 15 million events per day, be sure to reserve additional system resources to support the additional data traffic.

View system resources in the SEM Events Console

  1. In the SEM Events Console, click the Settings button.

  1. On the Settings page, click the System Resources tab.

    The System resources settings shows the platform name, memory and CPU information, and the manager name, version, and IP address. You can also access the one-click download debugs feature.

    Details pane descriptions
    FieldDescription
    Platform The Manager platform name, which can be Trigeo SIM, VMware vSphere, or Microsoft Hyper-V.
    CPU ReservationThe reserved CPU memory. Reserving CPU memory ensures enough system resources are available for the allocated CPUs.
    Number of CPUsThe number of processors allocated to the virtual appliance.
    Memory AllocationThe maximum amount of memory the Manager can use. Set this value at or above the reservation value. You can define this value in the VM configuration. Setting memory allocation to a greater value than the memory reservation has little effect on SEM performance.
    Memory Reservation The amount of memory reserved for this system.

    Name

    The Manager or appliance name.

    Version

    The Manager or appliance software version.

    IP Address

    The Manager or appliance IP address.

You can view your reservation settings using vSphere or an SSH client (such as PuTTY). See your VMware vSphere documentation for details about configuring resources, reservations, and storage on a vSphere virtual appliance.

View vSphere reservation settings for SEM

You can view reservation settings using the vSphere client. See your VMware vSphere documentation for details about configuring resources, reservations, and storage on a vSphere virtual machine.

  1. Log into vSphere and check the Settings/Reservations.

  2. Select SEM from the list (name listed may not be the host name), and view the Summary tab to find the number of CPUs (such as 2 vCPU).

    SEM requires at least two CPUs. The highest working setting for any SEM appliance is 16 CPUs.

  1. Provisioned Storage on the right side of the screen shows the total disk space SEM can use.

    • If SEM is set for thick provisioning, the used storage is always the total disk space.

    • Thin provisioning allows the used storage to grow to the total amount of storage allocated.

  2. On the Resource Allocation tab, note the CPU reservation on the left, and the memory reservations on the right.

  3. At the bottom left, check the CPU reservation. 2.0Ghz is SEM's minimum setting. To support higher speeds, see your VMware documentation for configuration information.

  4. See the Memory reservation at the bottom right. This reservation is normally set at 8 GB or higher. The Memory must be the same value or higher than the reservation. Memory reservations can be set as high as 64GB of RAM, which can support over 150 million events per day.

Change vSphere reservations for SEM

  1. Shut down the SEM VM. See Start and Stop SEM components for steps.
  2. Right-click the SEM VM to edit settings.

    Select the Hardware tab and change the allocated memory size.

  3. Select the Resources tab, and then change the CPU and memory settings.
    • Set the limit to unlimited for both CPU and memory reservations.
  4. To save the changes, click OK.
  5. Use the vSphere console to start the SEM VM.

View reservations settings using the CMC command-line

  1. Open the CMC command line. See Log in to the SEM CMC command line interface for steps.

  2. At the cmc> prompt, type manager.

  3. Type viewsysinfo, and then press Enter.

    The system returns memory and CPU information, as well as SEM version and license information.

  4. To return to the cmc::manager> prompt, type :q.
  5. To exit the manager menu, type exit.
  6. To exit the CMC command line, type exit at the cmc> prompt.

View Hyper-V reservation settings for SEM

Use the following tables to verify your Hyper-V client settings. For details about setting resources, reservations, and storage on a Hyper-V virtual appliance, see your Microsoft Hyper-V documentation.

Memory settings

Setting Value
Static RAM 8GB, 16GB, 24GB, 32GB, 64GB, 128GB, 256GB
Memory Weight High

CPU settings (Windows Server 2008)

Setting Value
Number of processors 2, 4, 6, 8, 10, 12, 14, 16
VM reserve CPU cycles 100%
Limit CPU Cycles 100%
Relative weight for CPU 100%

CPU settings (Windows Server 2012)

Setting Value
CPU memory details Click the Advanced tab and set the view and details
CPU Priority High
Reserve CPU cycle 100%
Limit CPU cycles 100%