Skip to main content
Skip table of contents

LogRhythm Reference Architecture

Gen 5/6 Reference Architecture

The tables in this section describe LogRhythm appliance platforms and performance specifications for each. You can use this information to determine what kind of systems you will use for installing LogRhythm.

New installations of the Data Indexer are only supported on Linux platforms or Windows in an XM configuration. Standalone Windows Data Indexers are not supported. With deployments in a Virtual or Public Cloud Environments we strongly recommend using the Linux version of the Data Indexer as a standalone machine rather than an XM configuration with the Data Indexer running in Windows.

SAN storage is supported in LogRhythm's software-only solution. It is not supported in LogRhythm appliances. With respect to appliances, SAN storage is supported only for inactive archives.

In the tables that follow, Allocation Unit Size is abbreviated as AUS. Where not otherwise specified, default AUS is expected.

XM systems with a DX offload have double the processing rate listed in the XM tables below.

Hardware Appliance Reference Architecture

Data Collector

Reference Platform

Performance (MPS)

Hardware

Operating System

Disk/Vol 1 Config

Disk/Vol 2 Config

LR-DC3500 Series

Sustained Collection Rate: 10,000

Burst Collection Rate: 25,000

  • 1 x 3.6 GHz 4 Core CPU

  • 8 vCPU

  • 16 GB RAM

  • H730P RAID controller

  • 2 x 1 Gigabit Ethernet NICs

Windows Server 2019 Standard Edition

Physical Disk:

  • 2 x 300 GB 10K RPM SAS RAID 1

  • Hardware IOPS: 150

  • Recommended IOPS: 150

Virtual Disk:

  • 278 GB usable

Logical Volume:

  • C Drive (200 GB)

  • D Drive (78 GB)

not applicable

LR-DCSLWS3600 Series

Sustained Collection Rate: 10,000

Burst Collection Rate: 25,000

  • Dell OEM R360 1-RU

  • 1 x Intel Xeon E-2486 3.5GHz, 6C/12T

  • 48 GB RAM

  • S160 RAID controller

  • 2 x 1 Gigabit Ethernet NICs

Windows Server 2022 Standard Edition

Physical Disk:

  • 2 x 480 GB M.2 SSD

  • 0.3 DWPD

  • RAID 1

  • Hardware IOPS: 85,000

  • Recommended IOPS: 150

Virtual Disk:

  • 440 GB usable

Logical Volume:

  • OS Drive (240 GB)

Physical Disk:

  • 2 x 480 GB SSD SATA

  • 1 DWPD

  • RAID 1

  • Hardware IOPS: 85,000

  • Recommended IOPS: 500

Virtual Disk:

  • 440 GB usable

Logical Volume:

  • S Drive (440 GB)

Web Console

Reference Platform

Performance (MPS)

Hardware

Operating System

Disk/Vol 1 Config

Disk/Vol 2 Config

LR-WC3500 Series

Web Console:

  • Max Event Rate: 1,000

  • Max Concurrent Users: 35

  • Hardware: 1 x 2.3 GHz 16 Core CPU

  • Min: 16vCPU Hardware: 32 vCPU

  • Min: 32 GB RAM Hardware: 48 GB RAM

  • H750 RAID controller with 8GB Cache

  • 2 x 10 Gb/s NICs

  • 2 x 1 Gb/s NICs

Windows Server 2019 Standard Edition

Physical Disk:

  • 2 x 240 GB M.2 SSD

  • 0.3 DWPD

  • RAID 1

  • Hardware IOPS: 85,000

  • Recommended IOPS: 150

Virtual Disk:

  • 220 GB usable

Logical Volume:

  • OS Drive (220 GB)

Physical Disk:

  • 2 x 480 GB SSD SATA

  • 3 DWPD

  • RAID 1

  • Hardware IOPS: 85,000

  • Recommended IOPS: 1,000

Virtual Disk:

  • 480 GB usable

Logical Volume:

  • D Drive (480 GB)

LR-DCSLWS3600 Series

Web Console:

  • Max Event Rate: 1,000

  • Max Concurrent Users: 35

  • Dell OEM R360 1-RU

  • 1 x Intel Xeon E-2486 3.5GHz, 6C/12T

  • 48 GB RAM

  • S160 RAID controller

  • 2 x 1 Gigabit Ethernet NICs

Windows Server 2022 Standard Edition

Physical Disk:

  • 2 x 480 GB M.2 SSD

  • 0.3 DWPD

  • RAID 1

  • Hardware IOPS: 85,000

  • Recommended IOPS: 150

Virtual Disk:

  • 440 GB usable

Logical Volume:

  • OS Drive (440 GB)

Physical Disk:

  • 2 x 480 GB SSD SATA

  • 1 DWPD

  • RAID 1

  • Hardware IOPS: 85,000

  • Recommended IOPS: 500

Virtual Disk:

  • 440 GB usable

Logical Volume:

  • S Drive (440 GB)

XM

Reference Platform

Performance (MPS)

Hardware

Operating System

Disk/Vol 1 Config

Disk/Vol 2 Config

LR-XM2600 Series
(combined PM, DP, DX, AIE, Web, DC)

Data Processor:

  • Max Processing Rate: 2,000

AI Engine:

  • Max Processing Rate: 2,000

Data Indexer:

  • Indexing Rate: 2,000

Platform Manager:

  • Max Events Rate: 20

Web Console:

  • Max Concurrent Users: 5

Open Collector VM:

  • Max Processing Rate: 1,000

  • Dell OEM R660XS 1-RU

  • 1 x Intel Xeon Silver 4410Y 2G, 12C/24T, 16GT/s, 23M Cache

  • 128 GB RAM (4x32GB)

  • PERC H755 RAID Controller with 8GB Cache

  • 4 x 10 Gb/s Base-T OCP NICs

  • 2 x 1 Gb/s Base-T LOM NICs

Windows Server 2022 Standard Edition

Physical Disk:

  • 2 x 480 GB M.2 SSD

  • 0.3 DWPD

  • RAID 1

Virtual Disk:

  • 480 GB

Logical Volume:

  • C Drive (480 GB)

Physical Disk:

  • 8 x 480 GB SSD SATA 6Gb/s

  • 1 DWPD

  • RAID 6

Virtual Disk:

  • 2.4 TB

Logical Volume:

  • D Drive (2.1 TB, 64K AUS)

  • L Drive (102 GB, 64K AUS)

  • S Drive (256 GB, 64K AUS)

  • T Drive (50 GB, 64K AUS)

LR-XM4600 Series
(combined PM, DP, DX, AIE, Web, DC)

Data Processor:

  • Max Processing Rate: 5,000

AI Engine:

  • Max Processing Rate: 5,000

Data Indexer:

  • Indexing Rate: 5,000

Platform Manager:

  • Max Events Rate: 50

Web Console:

  • Max Concurrent Users: 10

Open Collector VM:

  • Max Processing Rate: 2,000

  • Dell OEM R660XS 1-RU

  • 2 x Intel Xeon Silver 4410Y 2G, 12C/24T, 16GT/s, 30M Cache

  • 192 GB RAM (12x16GB)

  • PERC H755 RAID Controller with 8GB Cache

  • 4 x 10 Gb/s Base-T OCP NICs

  • 2 x 1 Gb/s Base-T LOM NICs

Windows Server 2022 Standard Edition

Physical Disk:

  • 2 x 480 GB M.2 SSD

  • 0.3 DWPD

  • RAID 1

Virtual Disk:

  • 480 GB

Logical Volume:

  • C Drive (480 GB)

Physical Disk:

  • 10 x 1.92TB SSD SATA 6Gb/s

  • 1 DWPD

  • RAID 6

Virtual Disk:

  • 15 TB

Logical Volume:

  • D Drive (14 TB, 64K AUS)

  • L Drive (256 GB, 64K AUS)

  • S Drive (512 GB, 64k AUS)

  • T Drive (150 GB, 64K AUS)

LR-XM6600 Series
(combined PM, DP, DX, AIE, Web, DC)

Data Processor:

  • Max Processing Rate: 10,000

AI Engine:

  • Max Processing Rate: 10,000

Data Indexer:

  • Max Indexing Rate: 10,000

Platform Manager:

  • Max Events Rate: 200

Web Console:

  • Max Concurrent Users: 15

Open Collector VM:

  • Max Processing Rate: 3,000

  • Dell OEM R660XS 1-RU

  • 2 x Intel Xeon Gold 6426Y 2.5G, 16C/32T, 16GT/s, 30M Cache

  • 256 GB RAM (16x16GB)

  • PERC H755 RAID Controller with 8GB Cache

  • 4 x 10 Gb/s Base-T OCP NICs

  • 2 x 1 Gb/s Base-T LOM NICs

Windows Server 2022 Standard Edition

Physical Disk:

  • 2 x 480 GB M.2 SSD

  • 0.3 DWPD

  • RAID 1

Virtual Disk:

  • 480 GB

Logical Volume:

  • C Drive (480 GB)

Physical Disk:

  • 10 x 3.8 TB SSD SATA 6Gb/s

  • 1 DWPD

  • RAID 6

Virtual Disk:

  • 28 TB

Logical Volume:

  • D Drive (26 TB, 64K AUS)

  • L Drive (512 GB, 64K AUS)

  • S Drive (1 TB, 64K AUS)

  • T Drive (200 GB. 64k AUS)

LR-XM8600 Series
(combined PM, DP, DX, AIE, Web, DC)

Data Processor:

  • Max Processing Rate: 20,000

AI Engine:

  • Max Processing Rate: 20,000

Data Indexer VM:

  • Max Indexing Rate: 20,000

Platform Manager:

  • Max Events Rate: 400

Web Console:

  • Max Concurrent Users: 25

OpenCollector VM:

  • Max Processing Rate: 3,000

  • Dell OEM R760 2-RU

  • 2 x Intel Xeon Gold 6448Y 2.1G, 32C/64T, 16GT/s, 60M Cache

  • 384 GB RAM (24x16GB)

  • PERC H755 RAID Controller with 8GB Cache

  • 4 x 10 Gb/s Base-T OCP NICs

  • 2 x 1 Gb/s Base-T LOM NICs

Windows Server 2022 Standard Edition

Rocky 9.x Virtualized Data Indexer

Physical Disk:

  • 2 x 480 GB M.2 SSD

  • 0.3 DWPD

  • RAID 1

Virtual Disk:

  • 480 GB

Logical Volume:

  • C Drive (480 GB)

Physical Disk:

  • 19 x 3.8 TB SSD SAS 24Gb/s

  • 1 DWPD

  • RAID 6

Virtual Disk:

  • 60 TB

Logical Volume:

  • D Drive (57 TB, 64K AUS)

  • L Drive (1 TB, 64K AUS)

  • S Drive (2 TB, 64K AUS)

  • T Drive (300 GB, 64k AUS)

Platform Manager

Reference Platform

Performance (MPS)

Hardware

Operating System

Disk/Vol 1 Config

Disk/Vol 2 Config

Disk/Vol 3 Config

LR-PM7600 Series

Platform Manager:

  • Max LogMart Rate: 2,000

  • Max Events Rate: 1,000

AI Engine:

  • Max MPS Rate: 50,000

Web Console:

  • Max Concurrent Users: 35

  • Dell OEM R760 2-RU

  • 2 x Intel Xeon Gold 6426Y 2.5G, 16C/32T, 16GT/s, 30M Cache

  • 256 GB RAM (16x16GB)

  • PERC H755 RAID Controller with 8GB Cache

  • 4 x 10 Gb/s Base-T OCP NICs

Windows Server 2022 Standard Edition

Physical Disk:

  • 2 x 480 GB M.2 SSD

  • 0.3 DWPD

  • RAID 1

Virtual Disk:

  • 480 GB

Logical Volume:

  • C Drive (480 GB)

Physical Disk:

  • 15 x 900 GB SSD SATA 6Gb/s

  • 1 DWPD

  • RAID 5 + 1 HS

Virtual Disk:

  • 12 TB

Logical Volume:

  • D Drive (12 TB, 64K AUS)

Physical Disk:

  • 8 x 900 GB SSD SATA 6Gb/s

  • 1 DWPD

  • RAID 10 + 1 HS

Virtual Disk:

  • 3.5 TB

Logical Volume:

  • L Drive (2.2 TB, 64K AUS)

  • S Drive (1 TB, 64K AUS)

  • T Drive (300 GB, 64k AUS)

Data Processor

Reference Platform

Performance (MPS)

Hardware

Operating System

Disk/Vol 1 Config

Disk/Vol 2 Config

Disk/Vol 3 Config

LR-DP7600 Series

Data Processor:

  • Max Processing Rate: 40,000

  • Dell OEM R660xs 1-RU

  • 2 x Intel Xeon Gold 6426Y 2.5G, 16C/32T, 16GT/s, 30M Cache

  • 128 GB RAM (8x16GB)

  • PERC H755 RAID Controller with 8GB Cache

  • 4 x 10 Gb/s Base-T OCP NICs

  • 2 x 1 Gb/s Base-T LOM NICs

Windows Server 2022 Standard Edition

Physical Disk:

  • 2 x 480 GB M.2 SSD

  • 0.3 DWPD

  • RAID 1

Virtual Disk:

  • 480 GB

Logical Volume:

  • C Drive (480 GB)

Physical Disk:

  • 4 x 8 TB 7.2K RPM SAS

  • RAID 5 + 1 HS

Virtual Disk:

  • 16 TB

Logical Volume:

  • D Drive (16 TB)

Physical Disk:

  • 2 x 1.92 TB SSD SATA 6Gb/s

  • 3 DWPD

  • RAID 1

Virtual Disk:

  • 1.8 TB usable

Logical Volume:

  • S Drive (1.8 TB)

Data Indexer

Reference Platform

Performance (MPS)

Hardware

Operating System

Disk/Vol 1 Config

Disk/Vol 2 Config

LR-DX5600 Series

Data Indexer:

  • Pinned Indexing Rate: 10,000

  • Clustered Indexing Rate: 6,000/node

  • Dell OEM R660xs 1-RU

  • 1 x Intel Xeon Gold 6426Y 2.5G, 16C/32T, 16GT/s, 30M Cache

  • 128 GB RAM (8x16GB)

  • PERC H755 RAID Controller with 8GB Cache

  • 4 x 10 Gb/s Base-T OCP NICs

  • 2 x 1 Gb/s Base-T LOM NICs

Rocky 9.x

Physical Disk:

  • 2 x 480 GB M.2 SSD

  • 0.3 DWPD

  • RAID 1

Virtual Disk:

  • 480 GB

Logical Volume:

  • / (480 GB)

Physical Disk:

  • 7 x 3.8 TB SSD SATA 6Gb/s

  • 1 DWPD

  • RAID 6

Virtual Disk:

  • 19 TB

Logical Volume:

  • /usr/local/logrhythm (19 TB)

LR-DX7600 Series

Data Indexer:

  • Pinned Indexing Rate: 20,000

  • Clustered Indexing Rate: 12,000/node

  • Dell OEM R760 2-RU

  • 2 x Intel Xeon Gold 6426Y 2.5G, 16C/32T, 16GT/s, 30M Cache

  • 256 GB RAM (16x16GB)

  • PERC H755 RAID Controller with 8GB Cache

  • 4 x 10 Gb/s Base-T OCP NICs

Rocky 9.x

Physical Disk:

  • 2 x 480 GB M.2 SSD

  • 0.3 DWPD

  • RAID 1

Virtual Disk:

  • 480 GB

Logical Volume:

  • / (480 GB)

Physical Disk:

  • 22 x 1.92 TB SSD SATA 6Gb/s

  • 1 DWPD

  • RAID 6

Virtual Disk:

  • 38 TB

Logical Volume:

  • /usr/local/logrhythm (38 TB)

LR-DXW6160

Data Indexer:

  • Max Indexing Rate: 0

  • Dell OEM R760 2-RU

  • 1 x Intel Xeon SIlver 4410Y 2G, 12C/24T, 16GT/s, 23M Cache

  • 128 GB RAM (8x16GB)

  • PERC H755 RAID Controller with 8GB Cache

  • 4 x 10 Gb/s Base-T OCP NICs

Rocky 9.x

Physical Disk:

  • 2 x 480 GB M.2 SSD

  • 0.3 DWPD

  • RAID 1

Virtual Disk:

  • 480 GB

Logical Volume:

  • / (480 GB)

Physical Disk:

  • 12 x 16 TB 7.2K RPM SATA

  • RAID 6

Virtual Disk:

  • 149 TB

Logical Volume:

  • /usr/local/logrhythm (149 TB)

AI Engine

Reference Platform

Performance (MPS)

Hardware

Operating System

Disk/Vol 1 Config

Disk/Vol 2 Config

LR-AIE7600 Series

AI Engine:

  • Max MPS: 75,000

  • Max Number of Rules: 2,000

  • Dell OEM R660xs 1-RU

  • 2 x Intel Xeon Gold 6426Y 2.5G, 16C/32T, 16GT/s, 30M Cache

  • 128 GB RAM (8x16GB)

  • PERC H755 RAID Controller with 8GB Cache

  • 4 x 10 Gb/s Base-T OCP NICs

  • 2 x 1 Gb/s Base-T LOM NICs

Windows Server 2022 Standard Edition

Physical Disk:

  • 2 x 480 GB M.2 SSD

  • 0.3 DWPD

  • RAID 1

Virtual Disk:

  • 480 GB

Logical Volume:

  • C Drive (480 GB)

Physical Disk:

  • 2 x 1.92 TB SSD SATA 6Gb/s

  • 3 DWPD

  • RAID 1

Virtual Disk:

  • 1.8 TB usable

Logical Volume:

  • S Drive (1.8 TB)

Network Monitor

Reference Platform

Performance (MPS)

Hardware

Operating System

Disk/Vol 1 Config

Disk/Vol 2 Config

LR-NM3500

1 Gb Network Monitor

  • 1 x 2.3 GHz 12 Core CPU

  • 24 vCPU

  • 64 GB RAM

  • PERC H750 RAID Controller with 8GB Cache

  • 2 x 10 Gb/s NICs

  • 2 x 1 Gb/s NICs

CentOS 7.6

Physical Disk:

  • 2 x 240 GB M.2 SSD

  • 0.3 DWPD

  • RAID 1

  • Hardware IOPS: 85,000

  • Recommended IOPS: 150

Virtual Disk:

  • 220 GB usable

Logical Volume:

  • OS Drive (220 GB)

Physical Disk:

  • 8 x 600 GB 10K RPM SAS

  • RAID 5 + 1 HS

  • Hardware IOPS: 717

  • Recommended IOPS: 717

Virtual Disk:

  • 3312 GB usable

Logical Volume:

  • Data Drive (3312 GB)

LR-NM5500

5 Gb Network Monitor

  • 2 x 2.6 GHz 14 Core CPU

  • 56 vCPU

  • 128 GB RAM

  • PERC H750 RAID Controller with 8GB Cache

  • 2 x 10 Gb/s NICs

  • 2 x 1 Gb/s NICs

CentOS 7.6

Physical Disk:

  • 2 x 240 GB M.2 SSD

  • 0.3 DWPD

  • RAID 1

  • Hardware IOPS: 85,000

  • Recommended IOPS: 150

Virtual Disk:

  • 220 GB usable

Logical Volume:

  • OS Drive (220 GB)

Physical Disk:

  • 24 x 600 GB 10K RPM SAS

  • RAID 5 + 1 HS

  • Hardware IOPS: 2115

  • Recommended IOPS: 2115

Virtual Disk:

  • 12284 GB usable

Logical Volume:

  • Data Drive (12232 GB)

Storage Arrays

Reference Platform

Performance (MPS)

Hardware

Operating System

Disk/Vol 1 Config

SAAR5120 (direct attached storage for archives on Gen5 Appliances)

12 Gbps SAS

PERC H840 RAID Controller with 8 GB Cache

not applicable

Physical Disk:

  • 12 x 12 TB 7200 RPM SAS

  • RAID 5 + 1 HS

  • Hardware IOPS: 1135

Virtual Disk:

  • 120 TB usable

Logical Volume:

  • R Drive (120 TB)

SAAR6120 (direct attached storage for archives on Gen6 Appliances)

24 Gbps SAS

PERC H965e RAID Controller with 8 GB Cache

not applicable

Physical Disk:

  • 12 x 12 TB 7200 RPM SAS

  • RAID 6

Virtual Disk:

  • 120 TB usable

Logical Volume:

  • R Drive (120 TB)

Secondlook API

Reference Platform

Performance (MPS)

Hardware

Operating System

Disk/Vol 1 Config

Disk/Vol 2 Config

LR-DCSLWS3600 Series

Secondlook API:

  • Max Restoration Rate: 15,000

  • Dell OEM R360 1-RU

  • 1 x Intel Xeon E-2486 3.5GHz, 6C/12T

  • 48 GB RAM

  • S160 RAID controller

  • 2 x 1 Gigabit Ethernet NICs

Windows Server 2022 Standard Edition

Physical Disk:

  • 2 x 480 GB M.2 SSD

  • 0.3 DWPD

  • RAID 1

  • Hardware IOPS: 85,000

  • Recommended IOPS: 150

Virtual Disk:

  • 440 GB usable

Logical Volume:

  • OS Drive (440 GB)

Physical Disk:

  • 2 x 480 GB SSD SATA

  • 1 DWPD

  • RAID 1

  • Hardware IOPS: 85,000

  • Recommended IOPS: 500

Virtual Disk:

  • 440 GB usable

Logical Volume:

  • S Drive (440 GB)

Virtual Appliance Reference Architecture

Before deploying LogRhythm on Virtual Infrastructure, it is strongly advised to review the Virtualization Platform Considerations and Requirements section of the Review the Requirements for a new LogRhythm Deployment topic to understand if your virtual environment will be compatible and supported.

Various tables throughout this section make reference to “Virtual Disk Performance Profiles.” For more information on Performance Profiles, refer to the Disk Performance Profiles section, under the Virtualization Resource Requirements heading, of the Review the Requirements for a New LogRhythm Deployment topic.

Data Collector

Reference Platform

Performance (MPS)

VM Configuration

Operating System

Disk/Vol 1 Config

Disk/Vol 2 Config

LR-DC-Minimum-Windows

Sustained Collection Rate: 2,000-5,000

Burst Collection Rate: 10,000

Max Remote Windows Log Sources: 500

  • 4 vCPU at 2Ghz or greater

  • 16 GB RAM

  • 1 x 1 Gb/s NICs

Windows 2019 or 2022 Standard Edition

Virtual Disk:

  • 300 GB

  • Performance Profile - SSD/HDD

Logical Volume:

  • C Drive (300 GB) - OS

LR-DC-Minimum-NIX

Sustained Collection Rate: 2,000-5,000

Burst Collection Rate: 10,000

  • 4 vCPU at 2Ghz or greater

  • 16 GB RAM

  • 1 x 1 Gb/s NICs

RHEL 7/8/9

CentOS 7

Rocky 9

Virtual Disk:

  • 300 GB

  • Performance Profile - HDD/SSD

Logical Volume:

  • / (300 GB)

LR-DC3500 Series

Sustained Collection Rate: 10,000

Burst Collection Rate: 25,000

  • 8-16 vCPU at 2Ghz or greater

  • 16-32 GB RAM

  • 1 x 1 Gb/s NICs

Windows Server 2022 Standard Edition (recommended)

Rocky 9.x

RHEL 9.x

Virtual Disk:

  • 300 GB

  • Performance Profile - HDD/SSD

Logical Volume:

  • C Drive (300 GB) - OS

Virtual Disk:

  • 150-300GB

  • Performance Profile - HDD/SSD

Logical Volume:

  • S Drive (100-300 GB) - State

Web Console

Reference Platform

Performance (MPS)

VM Configuration

Operating System

Disk/Vol 1 Config

LR-WC3501 Series

Web Console:

  • Max Event Rate: 1,000

  • Max Concurrent Users: 35

  • 8-16 vCPU at 2Ghz or greater

  • Minimum: 32GB RAM

  • Recommended: 48GB RAM

  • 1 x 1 Gb/s NICs

Windows Server 2022 Standard Edition

Virtual Disk:

  • 300 GB

  • Performance Profile - SSD

Logical Volume:

  • C Drive (300 GB) - OS

XM

Reference Platform

Performance (MPS)

VM Configuration

Operating System

Disk/Vol 1 Config

Disk/Vol 2 Config

Disk/Vol 3 Config

Disk/Vol 3 Config

LR-XM2600 Series
(combined PM, DP, DX, AIE, Web, DC)

Data Processor:

  • Max Processing Rate: 2,000

AI Engine:

  • Max Processing Rate: 2,000

Data Indexer:

  • Indexing Rate: 2,000

Platform Manager:

  • Max LogMart Rate: 20

  • Max Events Rate: 20

Web Console:

  • Max Concurrent Users: 5

  • 24 vCPU at 2Ghz or greater

  • 96 GB RAM

  • 1 x 1 Gb/s NICs (non-HA/DR)

  • 2 x 1 Gb/s NICs (HA/DR)

Windows Server 2022 Standard Edition

Virtual Disk:

  • 480 GB

  • Performance Profile - HDD/SSD

Logical Volume:

  • C Drive (480 GB)

Virtual Disk:

  • 2.1 TB

  • Performance Profile - HDD/SSD

Logical Volume:

  • D Drive (2.1 TB, 64K AUS)

Virtual Disk:

  • 150 GB usable

  • Performance Profile - HDD/SSD

Logical Volume:

  • L Drive (100 GB, 64K AUS)

  • T Drive (50 GB, 64K AUS)

Virtual Disk:

  • 256 GB usable

  • Performance Profile - HDD/SSD

Logical Volume:

  • S Drive (256 GB, 64K AUS)

LR-XM4600 Series
(combined PM, DP, DX, AIE, Web, DC)

Data Processor:

  • Max Processing Rate: 5,000

AI Engine:

  • Max Processing Rate: 5,000

Data Indexer:

  • Max Indexing Rate: 5,000

Platform Manager:

  • Max LogMart Rate: 100

  • Max Events Rate: 100

Web Console:

  • Max Concurrent Users: 10

  • 48 vCPU at 2Ghz or greater

  • 192 GB RAM

  • 1 x 1 Gb/s NICs (non-HA/DR)

  • 2 x 10 Gb/s NICs (HA/DR)

Windows Server 2022 Standard Edition

Virtual Disk:

  • 480 GB

  • Performance Profile - HDD/SSD

Logical Volume:

  • C Drive (480 GB)

Virtual Disk:

  • 13 TB

  • Performance Profile - HDD/SSD

Logical Volume:

  • D Drive (13 TB, 64K AUS)

Virtual Disk:

  • 406 GB usable

  • Performance Profile - HDD/SSD

Logical Volume:

  • L Drive (256 GB)

  • T Drive (150 GB, 64K AUS)

Virtual Disk:

  • 512 GB usable

  • Performance Profile - HDD/SSD

Logical Volume:

  • S Drive (512 GB)

LR-XM6600 Series
(combined PM, DP, DX, AIE, Web, DC)

Data Processor:

  • Max Processing Rate: 10,000

AI Engine:

  • Max Processing Rate: 10,000

Data Indexer:

  • Max Indexing Rate: 10,000

Platform Manager:

  • Max LogMart Rate: 200

  • Max Events Rate: 200

Web Console:

  • Max Concurrent Users: 15

  • 64 vCPU at 2Ghz or greater

  • 256 GB RAM

  • 1 x 10 Gb/s NICs (non-HA/DR)

  • 2 x 10 Gb/s NICs (HA/DR)

Windows Server 2022 Standard Edition

Virtual Disk:

  • 480 GB

  • Performance Profile - HDD/SSD

Logical Volume:

  • C Drive (480 GB)

Virtual Disk:

  • 26 TB

  • Performance Profile - SSD

Logical Volume:

  • D Drive (26 TB, 64K AUS)

Virtual Disk:

  • 812 GB usable

  • Performance Profile - SSD

Logical Volume:

  • L Drive (512 GB, 64K AUS)

  • T Drive (300 GB, 64K AUS)

Virtual Disk:

  • 1 TB usable

  • Performance Profile - SSD

Logical Volume:

  • S Drive (1 TB)

LR-XM8600 Series

Not supported as a standalone virtual platform. Use an XM6600+DX7600 or alternative distributed component design

Platform Manager

Reference Platform

Performance (MPS)

Hardware

Operating System

Disk/Vol 1 Config

Disk/Vol 2 Config

Disk/Vol 3 Config

Disk/Vol 4 Config

LR-PM5600 Series

Platform Manager:

  • Max LogMart Rate: 800

  • Max Events Rate: 400

AI Engine:

  • Max MPS Rate: 20,000

Web Console:

  • Max Concurrent Users: 15

  • 20 vCPU at 2Ghz or greater

  • 64-128 GB RAM

  • 1 x 1 Gb/s NICs (non-HA/DR)

  • 2 x 1 Gb/s NICs (HA/DR)

Windows Server 2022 Standard Edition

Virtual Disk:

  • 480 GB

  • Performance Profile - HDD/SSD

Logical Volume:

  • C Drive (480 GB)

Virtual Disk:

  • 2.2 TB

  • Performance Profile - SSD

Logical Volume:

  • D Drive (2.2 TB, 64K AUS)

Virtual Disk:

  • 350 GB

  • Performance Profile - SSD

Logical Volume:

  • L Drive (300 GB, 64K AUS)

  • T Drive (50 GB, 64K AUS)

Virtual Disk:

  • 512 GB

  • Performance Profile - SSD

Logical Volume:

  • S Drive (512 GB, 64K AUS)

LR-PM7600 Series

Platform Manager:

  • Max LogMart Rate: 2,000

  • Max Events Rate: 1,000

AI Engine:

  • Max MPS Rate: 50,000

Web Console:

  • Max Concurrent Users: 35

  • 64 vCPU at 2.5Ghz or greater

  • 128-256 GB RAM

  • 1 x 10 Gb/s NICs (non-HA/DR)

  • 2 x 10 Gb/s NICs (HA/DR)

Windows Server 2022 Standard Edition

Virtual Disk:

  • 480 GB

  • Performance Profile - HDD/SSD

Logical Volume:

  • C Drive (480 GB)

Virtual Disk:

  • 12 TB

  • Performance Profile - SSD

Logical Volume:

  • D Drive (12 TB, 64K AUS)

Virtual Disk:

  • 2.5 TB

  • Performance Profile - SSD

Logical Volume:

  • L Drive (2.2 TB, 64K AUS)

  • T Drive (300 GB, 64K AUS)

Virtual Disk:

  • 1 TB

  • Performance Profile - SSD

Logical Volume:

  • S Drive (1 TB, 64K AUS)

Data Processor

Reference Platform

Performance (MPS)

Hardware

Operating System

Disk/Vol 1 Config

Disk/Vol 2 Config (OPTIONAL)

Disk/Vol 3 Config

LR-DP5600 Series

Data Processor:

  • Max Processing Rate: 15,000

  • 24 vCPU at 2.5Ghz or greater

  • 64 GB RAM

  • 1 x 1 Gb/s NICs

Windows Server 2022 Standard Edition

Virtual Disk:

  • 480 GB

  • Performance Profile - HDD/SSD

Logical Volume:

  • C Drive (480 GB)

Virtual Disk:

  • 4 TB

  • Performance Profile - HDD

Logical Volume:

  • D Drive (4 TB)

Virtual Disk:

  • 920 GB

  • Performance Profile - SSD

Logical Volume:

  • S Drive (920 GB)

LR-DP7600 Series

Data Processor:

  • Max Processing Rate: 40,000

  • 48 vCPU at 2.5Ghz or greater

  • 128 GB RAM

  • 1 x 10 Gb/s NICs

Windows Server 2022 Standard Edition

Virtual Disk:

  • 480 GB

  • Performance Profile - HDD/SSD

Logical Volume:

  • C Drive (480 GB)

Virtual Disk:

  • 16 TB

  • Performance Profile - HDD

Logical Volume:

  • D Drive (16 TB)

Virtual Disk:

  • 1.8 TB

  • Performance Profile - SSD

Logical Volume:

  • S Drive (1.8 TB)

Data Indexer

Reference Platform

Performance (MPS)

Hardware

Operating System

Disk/Vol 1 Config

Disk/Vol 2 Config

LR-DX3600 Series

Data Indexer:

  • Pinned Indexing Rate: 5,000

  • Clustered Indexing Rate: 3,000/node

  • 24 vCPU at 2Ghz or greater

  • 64 GB RAM

  • 1 x 1 Gb/s NICs

Rocky 9.0+

Red Hat Enterprise Linux 9.0+

CentOS 7.4+

Red Hat Enterprise Linux 7.4+

Virtual Disk:

  • 480 GB

  • Performance Profile - HDD/SSD

Logical Volume:

  • / (480 GB)

Virtual Disk:

  • 8 TB

  • Performance Profile - HDD/SSD

Logical Volume:

  • /usr/local/logrhythm (8 TB)

LR-DX5600 Series

Data Indexer:

  • Pinned Indexing Rate: 10,000

  • Clustered Indexing Rate: 6,000/node

  • 32 vCPU at 2.5Ghz or greater

  • 128 GB RAM

  • 1 x 1 Gb/s NICs

Rocky 9.0+

Red Hat Enterprise Linux 9.0+

CentOS 7.4+

Red Hat Enterprise Linux 7.4+

Virtual Disk:

  • 480 GB

  • Performance Profile - HDD/SSD

Logical Volume:

  • / (480 GB)

Virtual Disk:

  • 19 TB

  • Performance Profile - SSD

Logical Volume:

  • /usr/local/logrhythm (19 TB)

LR-DX7600 Series

Data Indexer:

  • Pinned Indexing Rate: 20,000

  • Clustered Indexing Rate: 12,000/node

  • 48 vCPU at 2.1Ghz or greater

  • 256 GB RAM

  • 1 x 10 Gb/s NICs

Rocky 9.0+

Red Hat Enterprise Linux 9.0+

CentOS 7.4+

Red Hat Enterprise Linux 7.4+

Virtual Disk:

  • 480 GB

  • Performance Profile - HDD/SSD

Logical Volume:

  • / (480 GB)

Virtual Disk:

  • 38 TB

  • Performance Profile - SSD

Logical Volume:

  • /usr/local/logrhythm (38 TB)

LR-DXW6160

Data Indexer:

  • Max Indexing Rate: 0

  • 20 vCPU at 2.0Ghz or greater

  • 64-128 GB RAM

  • 1 x 10 Gb/s NICs

Rocky 9.0+

Red Hat Enterprise Linux 9.0+

CentOS 7.4+

Red Hat Enterprise Linux 7.4+

Virtual Disk:

  • 480 GB

  • Performance Profile - HDD/SSD

Logical Volume:

  • / (480 GB)

Virtual Disk:

  • 149 TB (adjustable)

  • Performance Profile - HDD

Logical Volume:

  • /usr/local/logrhythm (149 TB)

AI Engine

Reference Platform

Performance (MPS)

Hardware

Operating System

Disk/Vol 1 Config

Disk/Vol 2 Config

LR-AIE5600 Series

AI Engine:

  • Max MPS: 35,000

  • Max Number of Rules: 1,000

  • 32 vCPU at 2.5Ghz or greater

  • 64 GB RAM

  • 1 x 10 Gb/s NICs

Windows Server 2022 Standard Edition

Virtual Disk:

  • 480 GB

  • Performance Profile - HDD/SSD

Logical Volume:

  • C Drive (480 GB)

Virtual Disk:

  • 900 GB

  • Performance Profile - SSD

Logical Volume:

  • S Drive (900 GB)

LR-AIE7600 Series

AI Engine:

  • Max MPS: 75,000

  • Max Number of Rules: 2,000

  • 64 vCPU at 2.5Ghz or greater

  • 128 GB RAM

  • 1 x 10 Gb/s NICs

Windows Server 2022 Standard Edition

Virtual Disk:

  • 480 GB

  • Performance Profile - HDD/SSD

Logical Volume:

  • C Drive (480 GB)

Virtual Disk:

  • 1.8 TB

  • Performance Profile - SSD

Logical Volume:

  • S Drive (1.8 TB)

Network Monitor

Reference Platform

Performance (MPS)

Hardware

Operating System

Disk/Vol 1 Config

Disk/Vol 2 Config

LR-NM3500

1 Gb Network Monitor

  • 24 vCPU at 2.4Ghz or greater

  • 64 GB RAM

  • 4 x 1 Gb/s NICs

CentOS 7.6

Virtual Disk:

  • 480 GB

  • Performance Profile - HDD/SSD

Logical Volume:

  • C Drive (480 GB)

Virtual Disk:

  • 3.3TB

  • Performance Profile - HDD/SSD

Logical Volume:

  • Data Drive (3.3 TB)

LR-NM5500

5 Gb Network Monitor

  • 56 vCPU at 2.6Ghz or greater

  • 128 GB RAM

  • 4 x 10 Gb/s NICs

CentOS 7.6

Virtual Disk:

  • 480 GB

  • Performance Profile - HDD/SSD

Logical Volume:

  • C Drive (480 GB)

Virtual Disk:

  • 12.2 TB

  • Performance Profile - HDD/SSD

Logical Volume:

  • Data Drive (12.2 TB)

SecondLook Service

Reference Platform

Performance (MPS)

Hardware

Operating System

Disk/Vol 1 Config

LR-SLS5600

Data Processor:

  • Max Restoration Rate: 15,000

  • 16 vCPU at 2.5Ghz or greater

  • 12 GB RAM

  • 1 x 1 Gb/s NICs

Windows Server 2022 Standard Edition

Virtual Disk:

  • 480 GB

  • Performance Profile - HDD/SSD

Logical Volume:

  • C Drive (480 GB)

Virtual Sandboxes

The virtual platforms described in the table below are for labs/sandbox use only. They are not intended for production use.

Reference Platform

Performance (MPS)

Hardware

Operating System

Disk/Vol 1 Config

Disk/Vol 2 Config

LR-XMVS
(combined PM, DP, DX virtual server)

For labs/sandbox use only

Data Processor:

  • Max Processing Rate: 500

Data Indexer:

  • Max Indexing Rate: 500

Platform Manager:

  • Max LogMart Rate: 50

  • Max Events Rate: 25

  • 8 vCPU

  • 48 GB RAM

  • 1 NIC

Windows 2019 or 2022 Standard Edition

Disk:

  • 150 GB

  • Performance Profile - HDD/SSD

Logical Volume:

  • C Drive (110 GB)

  • L Drive (20 GB, 64K AUS)

  • T Drive (20 GB, 64K AUS)

Disk:

  • 150 GB

  • Performance Profile - HDD/SSD

Logical Volume:

  • D Drive (150 GB, 64K AUS)

LR-PMVS1
(dedicated PM virtual server)

For labs/sandbox use only

Platform Manager:

  • Max LogMart Rate: 50

  • Max Events Rate: 25

  • 4 vCPU

  • 16 GB RAM

  • 1 NIC

Windows 2019 or 2022 Standard Edition

Disk:

  • 150 GB

  • Performance Profile - HDD/SSD

Logical Volume:

  • C Drive (110 GB)

  • L Drive (20 GB, 64K AUS)

  • T Drive (20 GB, 64K AUS)

Disk:

  • 150 GB

  • Performance Profile - HDD/SSD

Logical Volume:

  • D Drive (150 GB, 64K AUS)

LR-DPVS1
(dedicated DP virtual server)

For labs/sandbox use only

Data Processor:

  • Max Processing Rate: 500

  • 4 vCPU

  • 8 GB RAM

  • 1 NIC

Windows 2019 or 2022 Standard Edition

Disk:

  • 150 GB

  • Performance Profile - HDD/SSD

Logical Volume:

  • C Drive (100 GB)

  • D Drive (50 GB)

not applicable

LR-DXVS1
(dedicated DX virtual server)

For labs/sandbox use only

Data Indexer:

  • Max Indexing Rate: 500

  • 4 vCPU

  • 32 GB RAM

  • 1 NIC

Rocky 9.0+

Red Hat Enterprise Linux 9.0+

Disk:

  • 100 GB

  • Performance Profile - HDD/SSD

Logical Volume:

  • OS Drive (100 GB)

Disk:

  • 300 GB

  • Performance Profile - HDD/SSD

Logical Volume:

  • Data Drive (300 GB)

AWS Platform Reference Architecture

AWS EC2 instances should be considered minimums. In some environments, higher performance instances may be required. Newer versions of matching instances are generally supported if available in your AWS region.

Data Collector

Reference Platform

Performance (MPS)

Instance Type

Operating System

Disk/Vol Config 1

Disk/Vol Config 2

LR-DC-Minimum-Windows

Sustained Collection Rate: 2,000-5,000

Burst Collection Rate: 10,000

Max Remote Windows Log Sources: 500

AWS: m7a.xlarge

vCPU: 4

Memory: 16GB

Windows 2019 or 2022 Standard Edition

Disk Type:

gp3 - 250 GB

Volume Size:

C Drive: 250 GB

Description:

Operating System

LR-DC-Minimum-NIX

Sustained Collection Rate: 2,000-5,000

Burst Collection Rate: 10,000

AWS: m7a.xlarge

vCPU: 4

Memory: 16GB

RHEL 7/8/9

CentOS 7

Rocky 9

Disk Type:

gp3 - 250 GB

Volume Size:

/

250 GB

Description:

Operating System

LR-DC-3500

Sustained Collection Rate: 10,000

Burst Collection Rate: 25,000

Max Remote Windows Log Sources: 500

AWS: c7a.4xlarge

vCPU: 8

Memory: 16GB

Windows 2019 or 2022 Standard Edition

Disk Type:

gp3 - 250 GB

Volume Size:

C Drive: 250 GB

Description:

Operating System

Disk Type:

gp3 - 100 GB

Volume Size:

D Drive: 100 GB

Description:

State

Web Console

Reference Platform

Performance (MPS)

Instance Type

Operating System

Disk/Vol Config 1

LR-WS3600

Web Console:

  • Max Event Rate: 1,000

  • Max Concurrent Users: 35

AWS: m7a.4xlarge

vCPU: 16

Memory: 64GB

Windows 2019 or 2022 Standard Edition

Disk Type:

gp3 - 300 GB

Volume Size:

C Drive: 300 GB

Description:

Operating System

XM

Reference Platform

Performance (MPS)

Instance Type

Operating System

Disk/Vol Config 1

Disk/Vol Config 2

Disk/Vol Config 3

Disk/Vol Config 4

LR-XM2600 Series
(Combined PM/DP/DX/AIE/Web Server)

Data Processor:

  • Max Processing Rate: 2,000

AI Engine:

  • Max Processing Rate: 2,000

Data Indexer:

  • Indexing Rate: 2,000

Platform Manager:

  • Max LogMart Rate: 20

  • Max Events Rate: 20

Web Console:

  • Max Concurrent Users: 5

AWS: r7i.4xlarge

vCPU: 16

Memory: 128GB

Windows 2019 or 2022 Standard Edition

Disk Type:

gp3 - 250 GB

Volume Size:

C Drive: 250 GB

Description:

Operating System

Disk Type:

gp3 - 800 GB

Volume Size:

D Drive: 500 GB

S Drive: 100 GB

L Drive: 150 GB

T Drive: 50 GB

Description:

SQL DB / SQL Logs /

State / Temp

Disk Type:

gp3 - 1500 GB

Volume Size:

E Drive: 1500 GB

Description:

Elasticsearch Data

not applicable

LR-XM4600 Series
(Combined PM/DP/DX/AIE/Web Server)

Data Processor:

  • Max Processing Rate: 5,000

AI Engine:

  • Max Processing Rate: 5,000

Data Indexer:

  • Max Indexing Rate: 5,000

Platform Manager:

  • Max LogMart Rate: 100

  • Max Events Rate: 100

Web Console:

  • Max Concurrent Users: 10

AWS: m7a.12xlarge

vCPU: 48

Memory: 192GB

Windows 2019 or 2022 Standard Edition

Disk Type:

gp3 - 250 GB

Volume Size:

C Drive: 250 GB

Description:

Operating System

Disk Type:

gp3 - 3000 GB

Volume Size:

D Drive: 2700 GB

S Drive: 250 GB

T Drive: 50 GB

Description:

SQL DB / State / Temp

Disk Type:

gp3 - 9000 GB

Volume Size:

E Drive: 9000 GB

Description:

Elasticsearch Data

Disk Type:

gp3 - 200 to 800 GB

Volume Size:

L Drive: 800 GB (if DR is used)

or

L Drive: 200 GB (if DR not used)

Description:

SQL Logs

LR-XM6600 Series
(Combined PM/DP/DX/AIE/Web Server)

Data Processor:

  • Max Processing Rate: 10,000

AI Engine:

  • Max Processing Rate: 10,000

Data Indexer:

  • Max Indexing Rate: 10,000

Platform Manager:

  • Max LogMart Rate: 200

  • Max Events Rate: 200

Web Console:

  • Max Concurrent Users: 15

AWS: m7a.16xlarge

vCPU: 64

Memory: 256GB

Windows 2019 or 2022 Standard Edition

Disk Type:

gp3 - 250 GB

Volume Size:

C Drive: 250 GB

Description:

Operating System

Disk Type:

gp3 - 5000 GB

Volume Size:

D Drive: 4500 GB

S Drive: 450 GB

T Drive: 50 GB

Description:

SQL DB / State / Temp

Disk Type:

gp3 - 16000 GB

Volume Size:

E Drive: 16000 GB

Description:

Elasticsearch Data

Disk Type:

gp3 - 200 to 800 GB

Volume Size:

L Drive: 800 GB (if DR is used)

or

L Drive: 200 GB (if DR not used)

Description:

SQL Logs

LR-XM8600 Series

Not supported as a standalone virtual platform. Use an XM6600+DX7600 or alternative distributed component design

Platform Manager

Reference Platform

Performance (MPS) 

Instance Type

Operating System

Disk/Vol Config 1

Disk/Vol Config 2

Disk/Vol Config 3

LR-PMC-Small

Platform Manager only:

  • Max Events Rate: 20

  • Max LogMart Rate: 0-Disabled

Deployments under 5000mps

DR/HA not supported

AWS:

r7i.xlarge

vCPU: 4

Memory: 32GB

Windows 2019 or 2022 Standard Edition

Disk Type:

gp3 - 250 GB

Volume Size:

C Drive: 250 GB

Description:

Operating System

Disk Type:

gp3 - 500 GB

Volume Size:

D Drive: 350 GB

L Drive: 50 GB

S Drive: 50 GB

T Drive 50 GB

Description:

SQL DB / SQL Logs / State / Temp

not applicable

LR-PMC-Large

Platform Manager only:

  • Max Events Rate: 100

  • Max LogMart Rate: 0-Disabled

Deployments between 5,000 to 10,000mps

DR/HA not supported

AWS:

m7a.2xlarge

vCPU: 8

Memory: 32GB

Windows 2019 or 2022 Standard Edition

Disk Type:

gp3 - 250 GB

Volume Size:

C Drive: 250 GB

Description:

Operating System

Disk Type:

gp3 - 1000 GB

Volume Size:

D Drive: 750 GB

L Drive: 100 GB

S Drive: 100 GB

T Drive 50 GB

Description:

SQL DB / SQL Logs / State / Temp

not applicable

LR-PM5600 Series

Platform Manager:

  • Max LogMart Rate: 800

  • Max Events Rate: 400

AI Engine:

  • Max MPS Rate: 20,000

Web Console:

  • Max Concurrent Users: 15

AWS:

r7i.4xlarge

vCPU: 16

Memory: 128GB

Windows 2019 or 2022 Standard Edition

Disk Type:

gp3 - 250 GB

Volume Size:

C Drive: 250 GB

Description:

Operating System

Disk Type:

gp3 - 1900 GB

Volume Size:

D Drive: 1600 GB

S Drive: 250 GB

T Drive 50 GB

Description:

SQL DB / State / Temp

Disk Type:

gp3 - 200 to 800 GB

Volume Size:

L Drive: 800 GB (if DR is used)

or

L Drive: 200 GB (if DR not used)

Description:

SQL Logs

LR-PM7600 Series

Platform Manager:

  • Max LogMart Rate: 2,000

  • Max Events Rate: 1,000

AI Engine:

  • Max MPS Rate: 50,000

Web Console:

  • Max Concurrent Users: 35

AWS:

m7i.12xlarge

vCPU: 48

Memory: 192GB

Windows 2019 or 2022 Standard Edition

Disk Type:

gp3 - 250 GB

Volume Size:

C Drive: 250 GB

Description:

Operating System

Disk Type:

gp3 - 5550 GB

Volume Size:

D Drive: 5000 GB

S Drive: 500 GB

T Drive 50 GB

Description:

SQL DB / State / Temp

Disk Type:

gp3 - 200 to 800 GB

Volume Size:

L Drive: 800 GB (if DR is used)

or

L Drive: 200 GB (if DR not used)

Description:

SQL Logs

DPAWC

Reference Platform

Performance (MPS)

Instance Type

Operating System

Disk/Vol Config 1

Disk/Vol Config 2

Disk/Vol Config 3

LR-DPAWC3600

Data Processor:

  • Max Processing Rate: 1,000

AI Engine:

  • Max Processing Rate: 1,000

Web Console:

  • Max Concurrent Users: 5

AWS: r7i.xlarge

vCPU: 4

Memory: 32GB

Windows 2019 or 2022 Standard Edition

Disk Type:

gp3 - 250 GB

Volume Size:

C Drive: 250 GB

Description:

Operating System

Disk Type:

gp3 - 150 GB

Volume Size:

S Drive: 150 GB

Description:

State

Disk Type:

sc1 - adjustable

Volume Size:

E Drive: 500 GB

Description:

Inactive Archives

(adjustable)

LR-DPAWC5600

Data Processor:

  • Max Processing Rate: 5,000

AI Engine:

  • Max Processing Rate: 5,000

Web Console:

  • Max Concurrent Users: 5

AWS: r7i.2xlarge

vCPU: 8

Memory: 64GB

Windows 2019 or 2022 Standard Edition

Disk Type:

gp3 - 250 GB

Volume Size:

C Drive: 250 GB

Description:

Operating System

Disk Type:

gp3 - 250 GB

Volume Size:

S Drive: 250 GB

Description:

State

Disk Type:

sc1 - adjustable

Volume Size:

E Drive: 1000 GB

Description:

Inactive Archives

(adjustable)

LR-DPAWC7600

Data Processor:

  • Max Processing Rate: 10,000

AI Engine:

  • Max Processing Rate: 10,000

Web Console:

  • Max Concurrent Users: 15

AWS: m7i.4xlarge

vCPU: 16

Memory: 64GB

Windows 2019 or 2022 Standard Edition

Disk Type:

gp3 - 250 GB

Volume Size:

C Drive: 250 GB

Description:

Operating System

Disk Type:

gp3 - 500 GB

Volume Size:

S Drive: 500 GB

Description:

State

Disk Type:

sc1 - adjustable

Volume Size:

E Drive: 2000 GB

Description:

Inactive Archives

(adjustable)

Data Processor

Reference Platform

Performance (MPS)

Instance Type

Operating System

Disk/Vol Config 1

Disk/Vol Config 2

Disk/Vol Config 3

LR-DP5600 Series

Data Processor:

  • Max Processing Rate: 15,000

AWS: c7i.8xlarge

vCPU: 32

Memory: 64GB

Windows 2019 or 2022 Standard Edition

Disk Type:

gp3 - 250 GB

Volume Size:

C Drive: 250 GB

Description:

Operating System

Disk Type:

gp3 - 500 GB

Volume Size:

S Drive: 500 GB

Description:

Active Archives and LR

State

Disk Type:

sc1 - adjustable

Volume Size:

E Drive: 2000 GB

Description:

Inactive Archives

(adjustable)

LR-DP7600 Series

Data Processor:

  • Max Processing Rate: 40,000

AWS: c7i.12xlarge

vCPU: 48 

Memory: 96GB

Windows 2019 or 2022 Standard Edition

Disk Type:

gp3 - 250 GB

Volume Size:

C Drive: 250 GB

Description:

Operating System

Disk Type:

gp3 - 1200 GB

Volume Size:

S Drive: 1200 GB

Description:

Active Archives and LR

State

Disk Type:

sc1 - adjustable

Volume Size:

E Drive: 8000 GB

Description:

Inactive Archives

(adjustable)

AI Engine

Reference Platform

Performance (MPS)

Instance Type

Operating System

Disk/Vol Config 1

Disk/Vol Config 2

LR-AIE7600 Series

AI Engine:

  • Max MPS: 75,000

  • Max Number of Rules: 2,000

AWS: c7i.12xlarge

vCPU: 48

Memory: 96GB

Windows 2019 or 2022 Standard Edition

Disk Type:

gp3 - 250 GB

Volume Size:

C Drive: 250 GB

Description:

Operating System

Disk Type:

gp3 - 500 GB

Volume Size:

D Drive: 500 GB

Description:

AIE State/Data

Data Indexer

Reference Platform

Performance (MPS)

Instance Type

Operating System

Disk/Vol Config 1

Disk/Vol Config 2

Disk/Vol Config 3

Disk/Vol Config 4

LR-DX1600 Series

Data Indexer:

  • Pinned Indexing Rate: 1,000

AWS: r7i.2xlarge

vCPU: 4

Memory: 64GB

AWS Marketplace Image:

Rocky Linux 9 (Official) - x86_64 by Rocky Linux

Disk Type:

gp3 - 250 GB

Volume Size:

/

250 GB

Description:

Operating System

Disk Type:

gp3 - 4400 GB

Throughput - default

IOPS - default

Volume Size:

/usr/local/logrhythm

4400 GB

Description:

Elasticsearch Data

not applicable

not applicable

LR-DX3600 Series

Data Indexer:

  • Pinned Indexing Rate: 5,000

  • Clustered Indexing Rate: 3000/node

AWS: m7i.4xlarge

vCPU: 16

Memory: 64GB

AWS Marketplace Image:

Rocky Linux 9 (Official) - x86_64 by Rocky Linux

Disk Type:

gp3 - 250 GB

Volume Size:

/

250 GB

Description:

Operating System

Disk Type:

gp3 - 8800 GB

Throughput - default

IOPS - default

Volume Size:

/usr/local/logrhythm

8800 GB

Description:

Elasticsearch Data

not applicable

not applicable

LR-DX5600 Series

Data Indexer:

  • Pinned Indexing Rate: 10,000

  • Clustered Indexing Rate: 6,000/node

AWS: m7i.8xlarge 

vCPU: 32

Memory: 128GB

AWS Marketplace Image:

Rocky Linux 9 (Official) - x86_64 by Rocky Linux

Disk Type:

gp3 - 250 GB

Volume Size:

/

250 GB

Description:

Operating System

Disk Type:

gp3 - 16000 GB

Throughput - 300MB/s

IOPS - 5000

Volume Size:

/usr/local/logrhythm

16000 GB

Description:

Elasticsearch Data

not applicable

not applicable

LR-DX7600 Series

Data Indexer:

  • Pinned Indexing Rate: 20,000

  • Clustered Indexing Rate: 12,000/node

AWS: m7i.16xlarge 

vCPU: 64

Memory: 256GB

AWS Marketplace Image:

Rocky Linux 9 (Official) - x86_64 by Rocky Linux

Disk Type:

gp3 - 250 GB

Volume Size:

/

250 GB

Description:

Operating System

Disk Type:

gp3 - 16000 GB

Throughput - 300MB/s

IOPS - 5000

Volume Size:

LVM - /usr/local/logrhythm

16000 GB

Description:

Elasticsearch Data

Disk Type:

gp3 - 16000 GB

Throughput - 300MB/s

IOPS - 5000

Volume Size:

LVM - /usr/local/logrhythm

16000 GB

Description:

Elasticsearch Data

not applicable

LR-DXW6160 Series
(dedicated warm tier)

Data Indexer:

  • Max Indexing Rate: 0

AWS: r7a.4xlarge 

vCPU: 16

Memory: 128GB

AWS Marketplace Image:

Rocky Linux 9 (Official) - x86_64 by Rocky Linux

Disk Type:

gp3 - 250 GB

Volume Size:

/

250 GB

Description:

Operating System

Disk Type:

st1 - 16000 GB

Volume Size:

LVM - /usr/local/logrhythm

16000 GB

Description:

Elasticsearch Data

Disk Type:

st1 - 16000 GB

Volume Size:

LVM - /usr/local/logrhythm

16000 GB

Description:

Elasticsearch Data

Additional disks based on TTL required

SecondLook Service

Reference Platform

Performance (MPS)

Hardware

Operating System

Disk/Vol 1 Config

LR-SLS5600

Data Processor:

  • Max Restoration Rate: 15,000

AWS: c7i.4xlarge

vCPU: 16

Memory: 32GB

Windows Server 2022 Standard Edition

Disk Type:

gp3 - 250 GB

Volume Size:

C Drive: 250 GB

Description:

Operating System

Google Cloud Platform Reference Architecture

Google Cloud instance sizes should be considered minimums. In some environments, higher performance instances may be required.

Data Collector

Reference Platform

Performance (MPS)

Instance Type

Operating System

Disk/Vol Config 1

Disk/Vol Config 2

LR-DC-Minimum-Windows

Sustained Collection Rate: 2,000-5,000

Burst Collection Rate: 10,000

Max Remote Windows Log Sources: 500

n2-standard-4

vCPU: 4

Memory: 16GB

Windows 2019 or 2022 Standard Edition

Disk Type:

pd-standard - 250 GB

Volume Size:

C Drive: 250 GB

Description:

Operating System

LR-DC-Minimum-NIX

Sustained Collection Rate: 2,000-5,000

Burst Collection Rate: 10,000

n2-standard-4

vCPU: 4

Memory: 16GB

RHEL 7/8/9

CentOS 7

Rocky 9

Disk Type:

pd-standard - 250 GB

Volume Size:

/

250 GB

Description:

Operating System

LR-DC3500

Sustained Collection Rate: 10,000

Burst Collection Rate: 25,000

Max Remote Windows Log Sources: 500

n2-custom

vCPU: 8

Memory: 16GB

Windows 2019 or 2022 Standard Edition

Disk Type:

pd-standard - 250 GB

Volume Size:

C Drive: 250 GB

Description:

Operating System

Disk Type:

pd-standard - 100 GB

Volume Size:

D Drive: 100 GB

Description:

LR State

Web Console

Reference Platform

Performance (MPS)

Instance Type

Operating System

Disk/Vol Config 1

LR-WS3501

Web Console:

  • Max Event Rate: 1,000

  • Max Concurrent Users: 35

n2-standard-16

vCPU: 16

Memory: 64GB

Windows 2019 or 2022 Standard Edition

Disk Type:

pd-standard - 300 GB

Volume Size:

C Drive: 300 GB

Description:

Operating System

XM

Reference Platform

Performance (MPS)

Instance Type

Operating System

Disk/Vol Config 1

Disk/Vol Config 2

Disk/Vol Config 3

Disk/Vol Config 4

LR-XM2600 Series
(Combined PM/DP/DX/AIE/Web Server)

Data Processor:

  • Max Processing Rate: 2,000

AI Engine:

  • Max Processing Rate: 2,000

Data Indexer:

  • Indexing Rate: 2,000

Platform Manager:

  • Max LogMart Rate: 20

  • Max Events Rate: 20

Web Console:

  • Max Concurrent Users: 5

n2-highmem-16

vCPU: 16

Memory: 128GB 

Windows 2019 or 2022 Standard Edition

Disk Type:

pd-standard - 250GB

Volume Size:

C Drive: 250 GB

Description:

Operating System

Disk Type:

pd-balanced - 800 GB

Volume Size:

D Drive: 500 GB

L Drive: 100 GB

S Drive: 150 GB

T Drive: 50 GB

Description:

SQL Databases/ES Data/SQL Logs/LR State/SQL Temp

Disk Type:

pd-balanced - 1500 GB

Volume Size:

E Drive: 1500 GB

Description:

Elasticsearch Data

not applicable

LR-XM4600 Series
(Combined PM/DP/DX/AIE/Web Server)

Data Processor:

  • Max Processing Rate: 5,000

AI Engine:

  • Max Processing Rate: 5,000

Data Indexer:

  • Max Indexing Rate: 5,000

Platform Manager:

  • Max LogMart Rate: 100

  • Max Events Rate: 100

Web Console:

  • Max Concurrent Users: 10

n2-custom

vCPU: 40

Memory: 196GB

Windows 2019 or 2022 Standard Edition

Disk Type:

pd-standard - 250GB

Volume Size:

C Drive: 250 GB

Description:

Operating System

Disk Type:

pd-balanced - 3000 GB

Volume Size:

D Drive: 2750 GB

S Drive: 250 GB

T Drive: 50 GB

Description:

SQL Databases/State/SQL Temp

Disk Type:

pd-balanced - 9000 GB

Volume Size:

E Drive: 9000 GB

Description:

ElasticSearch Data

Disk Type:

pd-balanced - 200 to 800 GB

Volume Size:

L Drive: 800 GB (if DR is used)

or

L Drive: 200 GB (if DR not used)

Description:

SQL Logs

LR-XM6600 Series
(Combined PM/DP/DX/AIE/Web Server)

Data Processor:

  • Max Processing Rate: 10,000

AI Engine:

  • Max Processing Rate: 10,000

Data Indexer:

  • Max Indexing Rate: 10,000

Platform Manager:

  • Max LogMart Rate: 200

  • Max Events Rate: 200

Web Console:

  • Max Concurrent Users: 15

n2-custom

vCPU: 48

Memory: 256GB

Windows 2019 or 2022 Standard Edition

Disk Type:

pd-standard - 250GB

Volume Size:

C Drive: 250 GB

Description:

Operating System

Disk Type:

pd-balanced - 5000 GB

Volume Size:

D Drive: 4.5 TB

S Drive: 450 GB

T Drive: 50 GB

Description:

SQL Databases/SQL Logs/SQL Temp

Disk Type:

pd-balanced - 16 TB

Volume Size:

E Drive: 16 TB

Description:

ElasticSearch Data

Disk Type:

pd-balanced - 200 to 800 GB

Volume Size:

L Drive: 800 GB (if DR is used)

or

L Drive: 200 GB (if DR not used)

Description:

SQL Logs

LR-XM8600 Series

Not supported as a standalone virtual platform. Use an XM6600+DX7600 or alternative distributed component design

Platform Manager

Reference Platform

Performance (MPS)

Instance Type

Operating System

Disk/Vol Config 1

Disk/Vol Config 2

Disk/Vol Config 3

LR-PMC-Small

Platform Manager only:

  • Max Events Rate: 20

  • Max LogMart Rate: 0-Disabled

Deployments under 5000mps

DR/HA not supported

n2-highmem-4

vCPU: 4

Memory: 32GB

Windows 2019 or 2022 Standard Edition

Disk Type:

pd-standard - 250GB

Volume Size:

C Drive: 250 GB

Description:

Operating System

Disk Type:

pd-balanced - 500 GB

Volume Size:

D Drive: 350 GB

L Drive: 50 GB

S Drive: 50 GB

T Drive 50 GB

Description:

SQL DB / SQL Logs / State / Temp

not applicable

LR-PMC-Large

Platform Manager only:

  • Max Events Rate: 100

  • Max LogMart Rate: 0-Disabled

Deployments between 5,000 to 10,000mps

DR/HA not supported

n2-standard-8

vCPU: 8

Memory: 32GB

Windows 2019 or 2022 Standard Edition

Disk Type:

pd-standard - 250GB

Volume Size:

C Drive: 250 GB

Description:

Operating System

Disk Type:

pd-balanced - 1000 GB

Volume Size:

D Drive: 750 GB

L Drive: 100 GB

S Drive: 100 GB

T Drive 50 GB

Description:

SQL DB / SQL Logs / State / Temp

not applicable

LR-PM5600 Series

Platform Manager:

  • Max LogMart Rate: 800

  • Max Events Rate: 400

AI Engine:

  • Max MPS Rate: 20,000

Web Console:

  • Max Concurrent Users: 15

n2-custom

vCPU: 20

Memory: 128GB

Windows 2019 or 2022 Standard Edition

Disk Type:

pd-standard - 250GB

Volume Size:

C Drive: 250 GB

Description:

Operating System

Disk Type:

pd-balanced - 2000 GB

Volume Size:

D Drive: 1600 GB

S Drive: 300 GB

T Drive: 100 GB

Description:

SQL DB / State / Temp

Disk Type:

pd-balanced - 200 to 800 GB

Volume Size:

L Drive: 800 GB (if DR is used)

or

L Drive: 400 GB (if DR not used)

Description:

SQL Logs

LR-PM7600 Series

Platform Manager:

  • Max LogMart Rate: 2,000

  • Max Events Rate: 1,000

AI Engine:

  • Max MPS Rate: 30,000

Web Console:

  • Max Concurrent Users: 35

n2-custom

vCPU: 48

Memory: 196GB

Windows 2019 or 2022 Standard Edition

Disk Type:

pd-standard - 250GB

Volume Size:

C Drive: 250 GB

Description:

Operating System

Disk Type:

pd-balanced - 8200 GB

Volume Size:

D Drive: 7500 GB

S Drive: 500 GB

T Drive: 200 GB

Description:

SQL DB / State / Temp

Disk Type:

pd-balanced - 200 to 800 GB

Volume Size:

L Drive: 2000 GB (if DR is used)

or

L Drive: 500 GB (if DR not used)

Description:

SQL Logs

DPAWC

Reference Platform

Performance (MPS)

Instance Type

Operating System

Disk/Vol Config 1

Disk/Vol Config 2

Disk/Vol Config 3

LR-DPAWC3600

Data Processor:

  • Max Processing Rate: 1,000

AI Engine:

  • Max Processing Rate: 1,000

Web Console:

  • Max Concurrent Users: 5

n2-highmem-4

vCPU: 4

Memory: 32GB

Windows 2019 or 2022 Standard Edition

Disk Type:

pd-standard - 250GB

Volume Size:

C Drive: 250 GB

Description:

Operating System

Disk Type:

pd-balanced - 150 GB

Volume Size:

S Drive: 150 GB

Description:

State

Disk Type:

pd-standard - adjustable

Volume Size:

E Drive: 500 GB

Description:

Inactive Archives

(adjustable)

LR-DPAWC5600

Data Processor:

  • Max Processing Rate: 5,000

AI Engine:

  • Max Processing Rate: 5,000

Web Console:

  • Max Concurrent Users: 5

n2-highmem-8

vCPU: 8

Memory: 64GB

Windows 2019 or 2022 Standard Edition

Disk Type:

pd-standard - 250GB

Volume Size:

C Drive: 250 GB

Description:

Operating System

Disk Type:

pd-balanced - 250 GB

Volume Size:

S Drive: 250 GB

Description:

State

Disk Type:

pd-standard - adjustable

Volume Size:

E Drive: 1000 GB

Description:

Inactive Archives

(adjustable)

LR-DPAWC7600

Data Processor:

  • Max Processing Rate: 10,000

AI Engine:

  • Max Processing Rate: 10,000

Web Console:

  • Max Concurrent Users: 15

n2-standard-16

vCPU: 16

Memory: 64GB

Windows 2019 or 2022 Standard Edition

Disk Type:

pd-standard - 250GB

Volume Size:

C Drive: 250 GB

Description:

Operating System

Disk Type:

pd-balanced - 500 GB

Volume Size:

S Drive: 500 GB

Description:

State

Disk Type:

pd-standard - adjustable

Volume Size:

E Drive: 2000 GB

Description:

Inactive Archives

(adjustable)

Data Processor

Reference Platform

Performance (MPS)

Instance Type

Operating System

Disk/Vol Config 1

Disk/Vol Config 2

Disk/Vol Config 3

LR-DP5600 Series

Data Processor:

  • Max Processing Rate: 15,000

n2-custom

vCPU: 24

Memory: 64GB

Windows 2019 or 2022 Standard Edition

Disk Type:

pd-standard - 250GB

Volume Size:

C Drive: 250 GB

Description:

Operating System

Disk Type:

pd-balanced - 500 GB

Volume Size:

S Drive: 500 GB

Description:

Active Archives/LR

State

Disk Type:

pd-standard - adjustable

Volume Size:

E Drive: 2000 GB

Description:

Inactive Archives

(adjustable)

LR-DP7600 Series

Data Processor:

  • Max Processing Rate: 40,000

n2-custom

vCPU: 48

Memory: 128GB

Windows 2019 or 2022 Standard Edition

Disk Type:

pd-standard - 250GB

Volume Size:

C Drive: 250 GB

Description:

Operating System

Disk Type:

pd-balanced - 1000 GB

Volume Size:

S Drive: 1000 GB

Description:

Active Archives/LR

State

Disk Type:

pd-standard - adjustable

Volume Size:

E Drive: 8000 GB

Description:

Inactive Archives

(adjustable)

AI Engine

Reference Platform

Performance (MPS)

Instance Type

Operating System

Disk/Vol Config 1

Disk/Vol Config 2

LR-AIE7600 Series

AI Engine:

Max MPS: 75,000

Max Number of Rules: 2,000

n2-custom

vCPU: 48

Memory: 128GB

Windows 2019 or 2022 Standard Edition

Disk Type:

pd-standard - 250GB

Volume Size:

C Drive: 250 GB

Description:

Operating System

Disk Type:

pd-balanced - 500 GB

Volume Size:

S Drive: 500 GB

Description:

AIE State/Data

Data Indexer

GCP only allows for a max volume of 64TB per instance. You will need to add multiple instances to meet the DXW5120 hardware appliance.

Reference Platform

Performance (MPS)

Instance Type

Operating System

Disk/Vol Config 1

Disk/Vol Config 2

Disk/Vol Config 3

LR-DX1600 Series

Data Indexer:

  • Pinned Indexing Rate: 1,000

n2-highmem-8

vCPU: 8

Memory: 64GB

Image Family:

rocky-linux-9-optimized-gcp

Disk Type:

pd-standard - 250 GB

Volume Size:

/

250 GB

Description:

Operating System

Disk Type:

pd-balanced - 4400 GB

Volume Size:

/usr/local/logrhythm

4400 GB

Description:

Elasticsearch Data

not applicable

LR-DX3600 Series

Data Indexer:

  • Pinned Indexing Rate: 5,000

  • Clustered Indexing Rate: 3000/node

n2-standard-16

vCPU: 16

Memory: 64GB

Image Family:

rocky-linux-9-optimized-gcp

Disk Type:

pd-standard - 250 GB

Volume Size:

/

250 GB

Description:

Operating System

Disk Type:

pd-balanced - 8800 GB

Volume Size:

/usr/local/logrhythm

8800 GB

Description:

Elasticsearch Data

not applicable

LR-DX5600 Series

Data Indexer:

  • Pinned Indexing Rate: 10,000

  • Clustered Indexing Rate: 6,000/node

n2-standard-32

vCPU: 32

Memory:128GB

Image Family:

rocky-linux-9-optimized-gcp

Disk Type:

pd-standard - 250 GB

Volume Size:

/

250 GB

Description:

Operating System

Disk Type:

pd-balanced - 16000 GB

Volume Size:

/usr/local/logrhythm

16000 GB

Description:

Elasticsearch Data

not applicable

LR-DX7600 Series

Data Indexer:

  • Pinned Indexing Rate: 20,000

  • Clustered Indexing Rate: 12,000/node

n2-standard-64

vCPU: 64

Memory: 256GB

Image Family:

rocky-linux-9-optimized-gcp

Disk Type:

pd-standard - 250 GB

Volume Size:

/

250 GB

Description:

Operating System

Disk Type:

pd-balanced - 32000 GB

Volume Size:

/usr/local/logrhythm

32000 GB

Description:

Elasticsearch Data

not applicable

LR-DXW6160
(dedicated warm tier)

Data Indexer:

  • Max Indexing Rate: 0

n2-highmem-16

vCPU: 16

Memory: 128GB

Image Family:

rocky-linux-9-optimized-gcp

Disk Type:

pd-standard - 250 GB

Volume Size:

/

250 GB

Description:

Operating System

*Disk Type:

pd-standard - 64000 GB

Volume Size:

/usr/local/logrhythm

64000 GB

Description:

Elasticsearch Data

Additional disks based on TTL required

SecondLook Service

Reference Platform

Performance (MPS)

Hardware

Operating System

Disk/Vol 1 Config

LR-SLS5600

Data Processor:

  • Max Restoration Rate: 15,000

c2-Custom

vCPU: 16

Memory: 16GB

Windows Server 2022 Standard Edition

Disk Type:

pd-standard - 250 GB

Volume Size:

C Drive: 250 GB

Description:

Operating System

Azure Platform Reference Architecture

Microsoft Azure instance sizes should be considered minimums. In some environments, higher performance instances may be required.

For all platforms, use only read host cache on data disks, such as SQL data or Elasticsearch data.

Data Collector

Reference Platform

Performance (MPS)

Instance Type

Operating System

Disk/Vol Config 1

Disk/Vol Config 2

LR-DC-Minimum-Windows

Sustained Collection Rate: 2,000-5,000

Burst Collection Rate: 10,000

Max Remote Windows Log Sources: 500

D4 v5

vCPU: 4

Memory: 16GB

Windows 2019 or 2022 Standard Edition

Disk Type:

S15 - 256 GB

Volume Size:

C Drive: 256 GB

Description:

Operating System

LR-DC-Minimum-NIX

Sustained Collection Rate: 2,000-5,000

Burst Collection Rate: 10,000

D4 v5

vCPU: 4

Memory: 16GB

RHEL 7/8/9

CentOS 7

Rocky 9

Disk Type:

S15 - 256 GB

Volume Size:

/

256 GB

Description:

Operating System

LR-DC3500

Sustained Collection Rate: 10,000

Burst Collection Rate: 25,000

Max Remote Windows Log Sources: 500

F8s v2

vCPU: 8

Memory: 16GB

Windows 2019 or 2022 Standard Edition

Disk Type:

S15 - 256 GB

Volume Size:

C Drive: 256 GB

Description:

Operating System

Disk Type:

S10 - 128 GB

Volume Size:

D Drive: 128 GB

Description:

State

Web Console

Reference Platform

Performance (MPS)

Instance Type

Operating System

Disk/Vol Config 1

LR-WS3501

Web Console:

  • Max Event Rate: 1,000

  • Max Concurrent Users: 35

D16 v5

vCPU: 16

Memory: 64GB

Windows 2019 or 2022 Standard Edition

Disk Type:

P20 - 512 GB

Volume Size:

C Drive: 512 GB

Description:

Operating System

XM

Reference Platform

Performance (MPS)

Instance Type

Operating System

Disk/Vol Config 1

Disk/Vol Config 2

Disk/Vol Config 3

Disk/Vol Config 4

LR-XM2600 Series
(combined PM/DP/DX/AIE/Web server)

Data Processor:

  • Max Processing Rate: 2,000

AI Engine:

  • Max Processing Rate: 2,000

Data Indexer:

  • Indexing Rate: 2,000

Platform Manager:

  • Max LogMart Rate: 20

  • Max Events Rate: 20

Web Console:

  • Max Concurrent Users: 5

E16 v5

vCPU: 16

Memory: 128GB 

Windows 2019 or 2022 Standard Edition

Disk Type:

S15 - 256 GB

Volume Size:

C Drive: 256 GB

Description:

Operating System

Disk Type:

E30 - 1024 GB

Volume Size:

D Drive: 775 GB

L Drive: 100 GB

S Drive: 100 GB

T Drive: 50 GB

Description:

SQL Data/SQL Logs/LR State/SQL Temp

Disk Type:

E40 - 2048 GB

Volume Size:

E Drive: 2048 GB

Description:

Elasticsearch Data

not applicable

LR-XM4600 Series
(combined PM/DP/DX/AIE/Web server)

Data Processor:

  • Max Processing Rate: 5,000

AI Engine:

  • Max Processing Rate: 5,000

Data Indexer:

  • Max Indexing Rate: 5,000

Platform Manager:

  • Max LogMart Rate: 100

  • Max Events Rate: 100

Web Console:

  • Max Concurrent Users: 10

D48 v5

vCPU: 48

Memory: 192GB

Windows 2019 or 2022 Standard Edition

Disk Type:

S15 - 256GB

Volume Size:

C Drive: 256 GB

Description:

Operating System

Disk Type:

E40 - 2048 GB

Volume Size:

D Drive: 1748 GB

S Drive: 250 GB

T Drive: 50 GB

Description:

SQL Data/SQL Logs/LR State/SQL Temp

Disk Type:

E60 - 8192 GB

Volume Size:

E Drive: 8192 GB

Description:

Elasticsearch Data

Disk Type:

P15 or P20 - 256 or 512 GB

Volume Size:

L Drive: 256 GB (if DR is used)

or

L Drive: 512 GB (if DR not used)

Description:

SQL Logs

LR-XM6600 Series
(combined PM/DP/DX/AIE/Web server)

Data Processor:

  • Max Processing Rate: 10,000

AI Engine:

  • Max Processing Rate: 10,000

Data Indexer:

  • Max Indexing Rate: 10,000

Platform Manager:

  • Max LogMart Rate: 200

  • Max Events Rate: 200

Web Console:

  • Max Concurrent Users: 15

D64 v5

vCPU: 64

Memory: 256GB

Windows 2019 or 2022 Standard Edition

Disk Type:

S15 - 256GB

Volume Size:

C Drive: 256 GB

Description:

Operating System

Disk Type:

E50 - 4096 GB

Volume Size:

D Drive: 3645 GB

L Drive: 150 GB

S Drive: 250 GB

T Drive: 50 GB

Description:

SQL Data/SQL Logs/LR State/SQL Temp

Disk Type:

E70 - 16384

Volume Size:

E Drive: 16384 GB

Description:

Elasticsearch Data

Disk Type:

P15 or P20 - 256 or 512 GB

Volume Size:

L Drive: 512 GB (if DR is used)

or

L Drive: 256 GB (if DR not used)

Description:

SQL Logs

LR-XM8600 Series

Not supported as a standalone virtual platform. Use an XM6600+DX7600 or alternative distributed component design

Platform Manager

Reference Platform

Performance (MPS)

Instance Type

Operating System

Disk/Vol Config 1

Disk/Vol Config 2

Disk/Vol Config 3

LR-PMC-Small

Platform Manager only:

  • Max Events Rate: 20

  • Max LogMart Rate: 0-Disabled

Deployments under 5000mps

DR/HA not supported

E4 v5

vCPU: 4

Memory: 32GB

Windows 2019 or 2022 Standard Edition

Disk Type:

S15 - 256GB

Volume Size:

C Drive: 256 GB

Description:

Operating System

Disk Type:

P20 - 512 GB

Volume Size:

D Drive: 350 GB

L Drive: 50 GB

S Drive: 50 GB

T Drive: 50 GB

Description:

SQL Data / SQL Logs / LR State / SQL Temp

not applicable

LR-PMC-Large

Platform Manager only:

  • Max Events Rate: 100

  • Max LogMart Rate: 0-Disabled

Deployments between 5,000 to 10,000mps

DR/HA not supported

D8 v5

vCPU: 8

Memory: 32GB

Windows 2019 or 2022 Standard Edition

Disk Type:

S15 - 256GB

Volume Size:

C Drive: 256 GB

Description:

Operating System

Disk Type:

P30 - 1024 GB

Volume Size:

D Drive: 750 GB

L Drive: 100 GB

S Drive: 100 GB

T Drive: 50 GB

Description:

SQL Data / SQL Logs / LR State / SQL Temp

not applicable

LR-PM5600 Series

Platform Manager:

  • Max LogMart Rate: 800

  • Max Events Rate: 400

AI Engine:

  • Max MPS Rate: 20,000

Web Console:

  • Max Concurrent Users: 15

E16 v5

vCPU: 16

Memory: 128GB

Windows 2019 or 2022 Standard Edition

Disk Type:

S15 - 256GB

Volume Size:

C Drive: 256 GB

Description:

Operating System

Disk Type:

P40 - 2048 GB

Volume Size:

D Drive: 1848 GB

S Drive: 100 GB

T Drive: 100 GB

Description:

SQL Data / LR State / SQL Temp

Disk Type:

P15 or P20 - 256 or 512 GB

Volume Size:

L Drive: 512 GB (if DR is used)

or

L Drive: 256 GB (if DR not used)

Description:

SQL Logs

LR-PM7600 Series

Platform Manager:

  • Max LogMart Rate: 2,000

  • Max Events Rate: 1,000

AI Engine:

  • Max MPS Rate: 30,000

Web Console:

  • Max Concurrent Users: 35

D32 v5

vCPU: 32

Memory: 128GB

Windows 2019 or 2022 Standard Edition

Disk Type:

S15 - 256GB

Volume Size:

C Drive: 256 GB

Description:

Operating System

Disk Type:

P50 - 4096 GB

Volume Size:

D Drive: 3896 GB

S Drive: 100 GB

T Drive: 100 GB

Description:

SQL Data / LR State / SQL Temp

Disk Type:

P20 or P30 - 512 or 1048 GB

Volume Size:

L Drive: 1048 GB (if DR is used)

or

L Drive: 512 GB (if DR not used)

Description:

SQL Logs

DPAWC

Reference Platform

Performance (MPS)

Instance Type

Operating System

Disk/Vol Config 1

Disk/Vol Config 2

Disk/Vol Config 3

LR-DPAWC3600

Data Processor:

  • Max Processing Rate: 1,000

AI Engine:

  • Max Processing Rate: 1,000

Web Console:

  • Max Concurrent Users: 5

E4 v5

vCPU: 4

Memory: 32GB

Windows 2019 or 2022 Standard Edition

Disk Type:

S15 - 256GB

Volume Size:

C Drive: 256 GB

Description:

Operating System

Disk Type:

P10 - 128 GB

Volume Size:

S Drive: 128 GB

Description:

State

Disk Type & Volume Size1

Description:

Inactive Archives

LR-DPAWC5600

Data Processor:

  • Max Processing Rate: 5,000

AI Engine:

  • Max Processing Rate: 5,000

Web Console:

  • Max Concurrent Users: 5

E8 v5

vCPU: 4

Memory: 64GB

Windows 2019 or 2022 Standard Edition

Disk Type:

S15 - 256GB

Volume Size:

C Drive: 256 GB

Description:

Operating System

Disk Type:

P15 - 256 GB

Volume Size:

S Drive: 256 GB

Description:

State

Disk Type & Volume Size1

Description:

Inactive Archives

LR-DPAWC7600

Data Processor:

  • Max Processing Rate: 10,000

AI Engine:

  • Max Processing Rate: 10,000

Web Console:

  • Max Concurrent Users: 15

D16 v5

vCPU: 16

Memory: 64GB

Windows 2019 or 2022 Standard Edition

Disk Type:

S15 - 256GB

Volume Size:

C Drive: 256 GB

Description:

Operating System

Disk Type:

P20 - 512 GB

Volume Size:

S Drive: 512 GB

Description:

State

Disk Type & Volume Size1

Description:

Inactive Archives

Data Processor

Reference Platform

Performance (MPS)

Instance Type

Operating System

Disk/Vol Config 1

Disk/Vol Config 2

Disk/Vol Config 3

LR-DP5600 Series

Max Processing Rate: 15,000

F32s v2

vCPU: 32

Memory: 64GB

Windows 2019 or 2022 Standard Edition

Disk Type:

S15 - 256GB

Volume Size:

C Drive: 256 GB

Description:

Operating System

Disk Type:

P20 - 512 GB

Volume Size:

S Drive: 512 GB

Description:

State

Disk Type & Volume Size1

Description:

Inactive Archives

LR-DP7600 Series

Max Processing Rate: 40,000

F64s v2

vCPU: 64

Memory: 128GB

Windows 2019 or 2022 Standard Edition

Disk Type:

S15 - 256GB

Volume Size:

C Drive: 256 GB

Description:

Operating System

Disk Type:

P30 - 1024

Volume Size:

S Drive: 1024 GB

Description:

State

Disk Type & Volume Size1

Description:

Inactive Archives

AI Engine

Reference Platform

Performance (MPS)

Instance Type

Operating System

Disk/Vol Config 1

Disk/Vol Config 2

LR-AIE7600 Series

Max MPS: 75,000

Max Number of Rules: 2,000

F64s v2

vCPU: 64

Memory: 128GB

Windows 2019 or 2022 Standard Edition

Disk Type:

S15 - 256GB

Volume Size:

C Drive: 256 GB

Description:

Operating System

Disk Type:

P20 - 512 GB

Volume Size:

S Drive: 512 GB

Description:

State

Data Indexer

The DX warm storage values do not match to appliances and can be adjusted based on customer need. Suggested Max DXW storage is 300TB per instance.

Reference Platform

Performance (MPS)

Instance Type

Operating System

Disk/Vol Config 1

Disk/Vol Config 2

Disk/Vol Config 3

Disk/Vol Config 4

Disk/Vol Config 5

LR-DX1600 Series

Data Indexer:

  • Pinned Indexing Rate: 1,000

E8 v5

vCPU: 8

Memory: 64GB

The Rocky Enterprise Software Foundation Inc: Rocky Linux 9

Disk Type :

S15 - 256GB

Volume Size:

/

256 GB

Description:

Operating System

Disk Type:

E50 - 4096GB

Volume Size:

/usr/local/logrhythm

4096 GB

Description:

Elasticsearch Data

not applicable

not applicable

not applicable

LR-DX3600 Series

Data Indexer:

  • Pinned Indexing Rate: 5,000

  • Clustered Indexing Rate: 3000/node

D16 v5

vCPU: 16

Memory: 64GB

The Rocky Enterprise Software Foundation Inc: Rocky Linux 9

Disk Type :

S15 - 256GB

Volume Size:

/

256 GB

Description:

Operating System

Disk Type:

E60 - 8192GB

Volume Size:

/usr/local/logrhythm

8192 GB

Description:

Elasticsearch Data

not applicable

not applicable

not applicable

LR-DX5600 Series

Data Indexer:

  • Pinned Indexing Rate: 10,000

  • Clustered Indexing Rate: 6,000/node

D32 v5

vCPU: 32

Memory: 128GB

The Rocky Enterprise Software Foundation Inc: Rocky Linux 9

Disk Type :

S15

Volume Size:

/

256 GB

Description:

Operating System

Disk Type:

E70 - 16384GB

Volume Size:

/usr/local/logrhythm

16,384 GB

Description:

Elasticsearch Data

not applicable

not applicable

not applicable

LR-DX7600 Series

Data Indexer:

  • Pinned Indexing Rate: 20,000

  • Clustered Indexing Rate: 12,000/node

D64 v5

vCPU: 64

Memory: 256GB

  

The Rocky Enterprise Software Foundation Inc: Rocky Linux 9

Disk Type :

S15

Volume Size:

/

256 GB

Description:

Operating System

Disk Type:

E70 - 16384GB

Volume Size:

/usr/local/logrhythm

Description:

Elasticsearch Data

Disk Type:

E70 - 16384GB

Volume Size:

/usr/local/logrhythm

Description:

Elasticsearch Data

not applicable

not applicable

LR-DXW6160 Series
(dedicated warm tier)

Data Indexer:

  • Max Indexing Rate: 0

E16 v5

vCPU: 16

Memory: 128GB

The Rocky Enterprise Software Foundation Inc: Rocky Linux 9

Disk Type :

S15

Volume Size:

/

256 GB

Description:

Operating System

Disk Type:

S80 - 32,767GB

Volume Size:

/usr/local/logrhythm

Description:

Elasticsearch Data

Disk Type:

S80 - 32,767GB

Volume Size:

/usr/local/logrhythm

Description:

Elasticsearch Data

Disk Type:

S80 - 32,767GB

Volume Size:

/usr/local/logrhythm

Description:

Elasticsearch Data

Additional disks based on TTL required

SecondLook Service

Reference Platform

Performance (MPS)

Hardware

Operating System

Disk/Vol 1 Config

LR-SLS5600

Data Processor:

  • Max Restoration Rate: 15,000

F16s

vCPU: 16

Memory: 32GB

Windows Server 2022 Standard Edition

Disk Type:

S15 - 256GB

Volume Size:

C Drive: 256 GB

Description:

Operating System

JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.

Contact Support Close