Documentation forSecurity Event Manager

SEM 2019.4 system requirements

March 26, 2020

SolarWinds strongly recommends that you install Security Event Manager on a server that is neither public, nor internet-facing. To learn about best practices for configuring your Security Event Manager installation securely, see Best practices to secure SolarWinds Products.

Use the following tables to plan your Security Event Manager (SEM) deployment to suit your network environment.

Server sizing is impacted by:

  • Number of nodes and network traffic. Consider event throughput and performance degradation when planning the size of your deployment. As the number of nodes and network traffic increase, the size of your deployment will need to grow with it. For example, if you are running a small deployment and begin to notice performance degradation at 300 nodes, move to a medium deployment.
  • Storing original (raw) log messages in addition to normalized log messages. If you will be storing original log messages, increase the CPU and memory resource requirements by 50 percent. See your hypervisor documentation for more information.

Sizing criteria

Use the following table to determine if a small, medium, or large deployment is best suited to supporting your environment.

Sizing Criteria Small Medium Large
Number of nodes

Fewer than 500 nodes in the following combinations:

  • 5 – 10 security devices
  • 10 – 250 network devices, including workstations
  • 30–150 servers

Between 300 and 2,000 nodes in the following combinations:

  • 10 – 25 security devices
  • 200 – 1,000 network devices, including workstations
  • 50 – 500 servers

More than 1,000 nodes in the following combinations:

  • 25 – 50 security devices
  • 250 – 1,000 network devices, including workstations
  • 500 – 1,000 servers
Events received per day 5M – 35M events 30M – 100M events

Up to 215m events (2,500 EPS)
Rules fired per day Up to 500 Up to 1,000 Up to 5,000

SEM VM hardware requirements

See Allocate CPU and memory resources to the SEM VM in the SEM Administrator Guide for information about how to manage SEM system resources.

Hardware on the VM host Small Medium Large
CPU

2 – 4 core processors at 2.0 GHz

6 – 10 core processors at 2.0 GHz

10 – 16 core processors at 2.0 GHz

If you will be storing original log messages in addition to normalized log messages, increase the CPU and memory resource requirements by 50%.
Memory 8 GB RAM 16 GB – 48 GB RAM 48 GB – 256 GB RAM
Hard drive storage 250GB, 15k hard drives (RAID 1/mirrored settings) 500GB, 15K hard drives (RAID 1/mirrored settings)

1TB, 15k hard drives (RAID 1/mirrored settings)
  • Installing SEM in a SAN is preferred.
  • High-speed hard drives (such as SSD drives) are required for high-end deployments.
  • Large deployments may require 1 to 2TB of storage, which you can reserve on VMware ESX(i) 6.5 (and later) and Microsoft Hyper-V 2012 R2 or 2016.
Input/output operations per second (IOPS) 40 – 200 IOPS 200 – 400 IOPS 400 or more IOPS
NIC 1 GBE NIC 1 GBE NIC 1 GBE NIC

SEM Azure hardware requirements

Hardware on the VM host

Small

Standard_DS3_v2

Medium

Standard_DS4_v2

Large

Standard_D32s_v3

CPU [cores]

4

8

32
RAM [GB] 14 28 128
IOPs 12800 25600 51200

SEM software requirements

Software Requirements
Hypervisor (required on the VM host)

One of the following:

  • VMware vSphere ESXi 5.0 or ESXi 5.0 and later
  • Microsoft Hyper-V Server 2016 or 2012 R2
Microsoft Azure Learn about Microsoft Azure requirements here.
Amazon Web Services Learn about Amazon Web Services requirements here.
Web browser (required on a remote computer to run the web console)

Current and later versions of the following:

  • Google® Chrome™ 71.0.3578
  • Mozilla Firefox® 64
Adobe Flash (browser plug-in required on a remote computer to run the web console) Adobe Flash Player 15

SEM agent hardware and software requirements

Hardware and Software Requirements
Operation System (OS)

The SEM agent is compatible with the following operating systems:

  • HPUX on Itanium

  • IBM AIX 7.1 TL3, 7.2 TL1 and later

  • Linux

  • macOS Mojave, Sierra, High Sierra

  • Oracle® Solaris 10 and later

  • Windows (10, 8, 7, Vista)

  • Windows Server (2019, 2016, 2012, 2008 R2)

The requirements specified below are minimum requirements. Depending on your deployment, you may need additional resources to support increased log-traffic volume and data retention.
Memory 512 MB RAM
Hard Drive Space 1 GB
Other requirements

Administrative access to the device hosting the SEM Agent.

The SEM agent for Mac OS X requires Java Runtime Environment (JRE) 8 or later.

SEM reports application hardware and software requirements

Hardware and Software Requirements
Operation System (OS)

The SEM reports application is Windows only. The following Windows versions are supported:

  • Windows 10 and later

  • Windows Server 2016 and 2012
Memory

512 MB RAM minimum.

SolarWinds recommends using a computer with 1 GB of RAM or more for optimal reports performance.
Other requirements

Install the SEM reports application on a system that runs overnight. This is important because the daily and weekly start time for these reports is 1:00 AM and 3:00 AM, respectively.

Ensure the Reports Console version matches your version of the SEM appliance. Incompatible versions may result in installation or login failures.

See the following articles in the Customer Success Center for troubleshooting tips:

SEM port requirements

If your logs are located behind firewalls, see SolarWinds SEM port and firewall requirements.

For a list of ports required to communicate with SolarWinds products, see Port requirements for all SolarWinds products.