Deployment Architecture

Hardware Requirements of a Deployment Server

aelliott
Motivator

What are the hardware requirements of a deployment server?

Does anyone have 1000+ devices connected to a deployment server? and what is your experience with your hardware allotted to it?

Tags (1)
1 Solution

lguinn2
Legend

AFAIK, there aren't any published hardware requirements for deployment servers. But if you think about what a deployment server does

  • Listens for "phonehomes" from many clients (network)
  • Allows clients to download apps (typically a few MB at most across the network)

Then you can see that the only bandwidth issue that a deployment server should have would be networking, if any. So a good quality NIC card would seem to be the biggest requirement.

Any reasonable disk system that can keep up with the network I/O would be fine. The apps to be deployed are typically quite small - measurable in KB or MB. It is likely that your OS will take more space on disk that the apps will.

It takes some CPU to drive the network cards at speed, but the deployment server isn't doing anything else, so I can't imagine that the system would be CPU-bound. Memory requirement is minimal as well.

So the deployment server is actually a great candidate for virtualization.

Typically, if you want to support more clients with one deployment server, you simply increase the phonehome interval in deploymentclient.conf on the clients. The default is 60 seconds, which Splunk says will support about 1000 clients. So if you changed the interval to 5 minutes, you should be able to support 5000 clients. But you could also run a second deployment server to split the load - this would be very easy if you were virtualizing the deployment server anyway.

I do know of Splunk users who have around a thousand deployment clients. Typically they do ratchet the phonehome interval. But I don't run such an environment myself, so someone else may give a better answer.

View solution in original post

lguinn2
Legend

AFAIK, there aren't any published hardware requirements for deployment servers. But if you think about what a deployment server does

  • Listens for "phonehomes" from many clients (network)
  • Allows clients to download apps (typically a few MB at most across the network)

Then you can see that the only bandwidth issue that a deployment server should have would be networking, if any. So a good quality NIC card would seem to be the biggest requirement.

Any reasonable disk system that can keep up with the network I/O would be fine. The apps to be deployed are typically quite small - measurable in KB or MB. It is likely that your OS will take more space on disk that the apps will.

It takes some CPU to drive the network cards at speed, but the deployment server isn't doing anything else, so I can't imagine that the system would be CPU-bound. Memory requirement is minimal as well.

So the deployment server is actually a great candidate for virtualization.

Typically, if you want to support more clients with one deployment server, you simply increase the phonehome interval in deploymentclient.conf on the clients. The default is 60 seconds, which Splunk says will support about 1000 clients. So if you changed the interval to 5 minutes, you should be able to support 5000 clients. But you could also run a second deployment server to split the load - this would be very easy if you were virtualizing the deployment server anyway.

I do know of Splunk users who have around a thousand deployment clients. Typically they do ratchet the phonehome interval. But I don't run such an environment myself, so someone else may give a better answer.

aelliott
Motivator

thanks! yes we will be doing virtualized.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...