9
configuration change). This parameter cannot be changed directly, but it can be altered if other settings relevant
to it are changed. For example, in advanced server configuration (under
Tools
>
Server Options
>
Server Maintenance
) you can setup the maximum amount of logs that can be accepted by the server (this
setting includes clients that connect directly as well as replicated clients).In regular operation the long-term
average can be estimated at 1 event every 4 hours per client.
4. Hardware and operating system used
We strongly recommend using the minimum hardware recommended for your server's operating system,
accounting for the number of clients to be serviced.
Overload
If a server is overloaded (e.g., we connect 20,000 clients to a server only able to service 10,000 clients at an interval of
every 10 minutes) it will skip some of the clients connected. On average every second client connection will be serviced,
as if the client connection interval were set to 20 minutes instead of 10 minutes. Every service denial will be logged as
follows: "
<SERVERMGR_WARNING> ServerThread: maximum number of threads for active connections reached (500), the
server will skip this connection
”. Service denials may also occur during temporary server overloads.
You can change the value under the
Maximum number of active connections
(the default is 500) in the advanced
server settings, but we recommend to do so only in exceptional cases (e.g. when solving specific issues). Should there
be an overabundance of system resources and database engine performance you can use this setting to adjust the
overall server performance.
Data transfer over a network
During a server's standard operation, we can estimate a client connecting every 10 minutes will report 0.04 events per
connection, which is 1 event reported every 4 hours per client. This will produce ~2 kilobytes of traffic per connection.
In a virus outbreak scenario, with a client reporting 7 events every time it connects traffic may increase up to 240
kilobytes per connection. If you use compression (default) the data transferred will be approximately 50% smaller in
size, i.e. about 120 kilobytes per connection.
The data includes direct client connections, omitting replicated connections. Replication occurs much less often and
serves to send new events from lower servers. Events to be automatically replicated and their verbosity level can be
configured in the advanced settings of the server (under
Tools
>
Server Options
>
Advanced
>
Edit Advanced Settings
>
Replication
). In the Server maintenance section you can configure the maximum level of
logs, that the upper server will accept - this setting applies to both directly connecting clients and replicated clients.
Storage capacity requirements
Clean installation of the product with an MS Access database takes up to 60 MB of disk space.
Most of the storage space is taken up by client events, that are stored in the database and to a repository on the disk
(default directory is
C:\Documents and Settings\All Users\Application Data\Eset\ESET Remote Administrator\Server
). ERA
requires that at least 5% of the disk be free. If this minimum is exceeded the server will stop receiving some of the client
events. This setting can be found under
Tools
>
Server Options
>
Advanced
>
Edit Advanced Settings
>
Advanced
>
Maximum disk space usage
. Approximately 10GB per 1000 clients of free disk space is required for regular operation
under the default cleanup settings (deleting events older than 3 months).
Case study
A server using an MS Access database that has clients connecting to it every 5 minutes and reporting 7 events (e.g.
threat log, event log, scan log, configuration change etc.) per connection in average can temporarily service up to 3000
clients. This scenario depicts a temporary overload situation, such as reporting during a virus outbreak etc.
If the server uses an external MySQL database and the client connection interval is set to 10 minutes (generating 0.02
events per connection) the maximum number of clients the server will be able to service increases to 30,000. Such a
scenario exhibits optimal database performance, with clients reporting a relatively small number of events.
In regular operation, using an MS Access database and a client connection interval of 10 minutes enables the server to
service a maximum of 10,000 clients.
