Allocate CPU and memory resources to the SEM VM
By default, SEM deploys with 8GB of RAM and 2 CPUs on the VMware ESX(i) and Microsoft Hyper-V platforms. For SEM to work properly, you must allocate sufficient CPU and memory resources to the SEM VM. This topic describes how to check resource settings and make updates.
See SEM system requirements in the SEM Installation Guide for hardware and software sizing requirements.
SEM can send SNMP version 3 alerts to SolarWinds Network Performance Monitor (NPM). This configuration allows you to monitor CPU, memory, and other critical SEM components from the SolarWinds Orion Web Console.
Security Event Manager collects data from a continuous stream of traffic that fluctuates based on user, server, and network activity. The type and volume of traffic varies based on the device sending the traffic and the audit and log settings on those devices.
About incoming data traffic
Security Event Manager receives data from syslogs and traps using up to 500 connectors that receive data traffic from several supported network devices. These connectors translate (or normalize) the data into a readable and understandable format you can view on the SEM Console.
The events appear in the Monitor view, pass through the rules engine for specified actions, and then move into a database for retrieval by the SEM Reports or nDepth search function. To process the data in real time, SEM requires system resource reservations from the virtual appliance host.
When the volume of traffic exceeds 15 million events per day, be sure to reserve additional system resources to support the additional data traffic.
- On the SEM Console, click the Settings button.
- On the Settings page, click the System Resources tab.
The System resources settings shows the platform name, memory and CPU information, and the manager name, version, and IP address. You can also access the one-click download debugs feature.
Details pane descriptions Field Description Platform The Manager platform name, which can be Trigeo SIM, VMware vSphere, or Microsoft Hyper-V. CPU Reservation The reserved CPU memory. Reserving CPU memory ensures enough system resources are available for the allocated CPUs. Number of CPUs The number of processors allocated to the virtual appliance. Memory Allocation The maximum amount of memory the Manager can use. Set this value at or above the reservation value. You can define this value in the VM configuration. Setting memory allocation to a greater value than the memory reservation has little effect on SEM performance. Memory Reservation The amount of memory reserved for this system.
The Manager or appliance name.
The Manager or appliance software version.
The Manager or appliance IP address.
You can view your reservation settings using vSphere or an SSH client (such as PuTTY). See your VMware vSphere documentation for details about configuring resources, reservations, and storage on a vSphere virtual appliance.
View vSphere reservation settings for SEM
You can view reservation settings using the vSphere client. See your VMware vSphere documentation for details about configuring resources, reservations, and storage on a vSphere virtual machine.
Log into vSphere and check the Settings/Reservations.
Select SEM from the list (name listed may not be the host name), and view the Summary tab to find the number of CPUs (such as 2 vCPU).
SEM requires at least two CPUs. The highest working setting for any SEM appliance is 16 CPUs.
Provisioned Storage on the right side of the screen shows the total disk space SEM can use.
If SEM is set for thick provisioning, the used storage is always the total disk space.
Thin provisioning allows the used storage to grow to the total amount of storage allocated.
On the Resource Allocation tab, note the CPU reservation on the left, and the memory reservations on the right.
At the bottom left, check the CPU reservation. 2.0Ghz is SEM's minimum setting. To support higher speeds, see your VMware documentation for configuration information.
See the Memory reservation at the bottom right. This reservation is normally set at 8 GB or higher. The Memory must be the same value or higher than the reservation. Memory reservations can be set as high as 64GB of RAM, which can support over 150 million events per day.
Change vSphere reservations for SEM
- Shut down the SEM VM. See Start and Stop SEM components for steps.
Right-click the SEM VM to edit settings.
Select the Hardware tab and change the allocated memory size.
- Select the Resources tab, and then change the CPU and memory settings.
- Set the limit to
unlimitedfor both CPU and memory reservations.
- Set the limit to
- To save the changes, click OK.
- Use the vSphere console to start the SEM VM.
View reservations settings using the CMC command-line
Open the CMC command line. See Log in to the SEM CMC command line interface for steps.
viewsysinfo, and then press Enter.
The system returns memory and CPU information, as well as SEM version and license information.
- To return to the
- To exit the manager menu, type
- To exit the CMC command line, type
Use the following tables to verify your Hyper-V client settings. For details about setting resources, reservations, and storage on a Hyper-V virtual appliance, see your Microsoft Hyper-V documentation.
|Static RAM||8GB, 16GB, 24GB, 32GB, 64GB, 128GB, 256GB|
CPU settings (Windows Server 2008)
|Number of processors||2, 4, 6, 8, 10, 12, 14, 16|
|VM reserve CPU cycles||100%|
|Limit CPU Cycles||100%|
|Relative weight for CPU||100%|
CPU settings (Windows Server 2012)
|CPU memory details||Click the Advanced tab and set the view and details|
|Reserve CPU cycle||100%|
|Limit CPU cycles||100%|