Performance Tuning, Retention, and Storage Management
This domain covers EPS and flow capacity, retention policy, and storage pressure.
Core rules
- Monitor licensed versus actual EPS and flow rate, CPU, memory, and disk in System Health and the performance dashboards.
- Retention is configured per data type: events, flows, offenses, assets. Longer retention consumes /store and slows searches.
- Data Nodes extend storage and search capacity; they do not replace tuning.
- Reduce volume at the source: collector filters, coalescing, disabling noisy log sources, and tightening rules.
- Store and Forward buffers events on collectors during outages; size buffers for expected outages.
- Ariel tuning and indexed properties affect search performance more than raw disk size.
Worked example
The license limit is exceeded and events drop. Log Activity shows one log source producing most of the volume. Applying a collector filter and coalescing for that source brings EPS under license before any hardware purchase. The reasoning: find the top talker first, then decide whether to filter, tune, or add capacity.
Traps
- Extending retention to "keep everything" and filling /store.
- Adding a Data Node but not including it in searches.
- Deleting data manually instead of adjusting retention.
- Ignoring flow volume because only EPS is licensed.
- Filtering events a compliance rule requires.