Documentation forSecurity Event Manager

Allocate CPU and memory resources to the SEM VM

By default, SEM deploys with 8GB of RAM and 2 CPUs on the VMware ESX(i) and Microsoft Hyper-V platforms. For SEM to function properly, allocate sufficient CPU and memory resources to the SEM VM.

SEM collects data from a continuous stream of fluctuating traffic based on user, server, and network activity. The type and volume of traffic varies based on the device sending the traffic and the audit and log settings on those devices.

See the SEM system requirements for hardware and software sizing requirements.

SEM can send SNMP version 3 alerts to Network Performance Monitor (NPM). This configuration allows you to monitor CPU, memory, and other critical SEM components from the SolarWinds Orion Web Console.

About incoming data traffic

SEM receives data from syslogs and traps using up to 500 connectors that receive data traffic from several supported network devices. These connectors translate (or normalize) the data into a readable and understandable format you can view on the SEM Console.

The events display in the Monitor view, pass through the rules engine for specified actions, and then move into a database for retrieval by the SEM Reports. To process the data in real time, SEM requires system resource reservations from the virtual appliance host.

If your traffic volume exceeds 15 million events per day, reserve additional system resources to support the additional data traffic.

View the system resources

  1. Log in to the SEM Console.

  2. On the toolbar, click the Settings icon.

  3. In the Settings page, click System Resources.

    The System resources window displays with details about the system resources. You can also access the one-click download debugs feature.

The following table describes each system resource.

Field Description
Platform The Manager platform name, which can be Trigeo SIM, VMware vSphere, or Microsoft Hyper-V.
CPU Reservation The reserved CPU memory. Reserving CPU memory ensures enough system resources are available for the allocated CPUs.
Number of CPUs The number of processors allocated to the virtual appliance.
Memory Allocation

The maximum amount of memory the Manager can use.

Set this value at or above the reservation value. You can define this value in the VM configuration. Setting memory allocation to a greater value than the memory reservation has little effect on SEM performance.
Memory Reservation The amount of memory reserved for this system.

Name

The Manager or appliance name.

Version

The Manager or appliance software version.

IP Address

The Manager or appliance IP address.

You can view your reservation settings using vSphere or an SSH client (such as PuTTY). See your VMware vSphere documentation for details about configuring resources, reservations, and storage on a vSphere virtual appliance.

View the vSphere reservation settings for SEM

You can view the reservation settings using the vSphere client. See your VMware vSphere documentation for details about configuring resources, reservations, and storage on a vSphere virtual machine.

  1. Log into vSphere and check the Settings/Reservations resource.

  2. Select SEM from the list (name listed may not be the host name), and view the Summary tab to find the number of CPUs (such as 2 vCPU).

    SEM requires at least two CPUs. The highest working setting for any SEM appliance is 16 CPUs.

    Provisioned Storage displays the total disk space SEM can use.

    If SEM is set for thick provisioning, the used storage is always the total disk space. Thin provisioning allows the used storage to grow to the total amount of storage allocated.

  1. On the Resource Allocation tab, record the CPU reservation and the memory reservations values.

  2. Check the CPU reservation. The minimum setting is 2.0Ghz. To support a higher processor speed, see your VMware documentation for configuration information.

  3. Check the Memory reservation. This value is normally set at 8 GB or higher. This value must be the same value or higher than the reservation.

    Memory reservations can be set as high as 64GB of RAM, which can support over 150 million events per day.

Change the vSphere reservations for SEM

  1. Shut down the SEM VM.

    See Start and stop the SEM appliance and agent for details.

  2. Right-click the SEM VM to edit the settings.

  3. Select the Hardware tab and change the allocated memory size.

  4. Select the Resources tab and update the CPU and memory settings.

    Set the limit to unlimited for both CPU and memory reservations.

  5. Click OK to save your changes.
  6. Use the vSphere console to start the SEM VM.

View reservations settings using the CMC command-line

  1. Open the CMC command line.

    See Log in to the SEM CMC command line interface for instructions.

  2. At the cmc> prompt, type manager.

  3. Type viewsysinfo, and then press Enter.

    The system returns memory and CPU information, as well as SEM version and license information.

    To return to the cmc::manager> prompt, type :q.

    To exit the manager menu, type exit.

    To exit the CMC command line, type exit at the cmc> prompt.

View Hyper-V reservation settings for SEM

Use the following tables to verify your Hyper-V client settings. For details about setting resources, reservations, and storage on a Hyper-V virtual appliance, see your Microsoft Hyper-V documentation.

Memory settings

Setting Value
Static RAM 8GB, 16GB, 24GB, 32GB, 64GB, 128GB, 256GB
Memory Weight High

CPU settings (Windows Server 2008 R2)

Setting Value
Number of processors 2, 4, 6, 8, 10, 12, 14, 16
VM reserve CPU cycles 100%
Limit CPU Cycles 100%
Relative weight for CPU 100%

CPU settings (Windows Server 2012)

Setting Value
CPU memory details Click the Advanced tab and set the view and details.
CPU Priority High
Reserve CPU cycle 100%
Limit CPU cycles 100%