Select a Method of Deploying NDR

Reference Architecture

The tables in this section describe NDR appliance platforms and performance specifications for each. You can use this information to determine what kind of systems you will use for installing NDR.
SAN storage is not recommended for the LogRhythm NDR solution
In the tables that follow, Allocation Unit Size is abbreviated as AUS. Where not otherwise specified, default AUS is expected.

NDR Physical

Reference Platform

Performance (MPS)

Hardware

Operating System

Disk/Vol 1 Config

Disk/Vol 2 Config

LR-NS7500

Ingestion rate:

Max ingestion - 5GB

2 x lntel Xeon Silver 4216 16 core CPU
64 vCPU
256 G8 RAM
PERC H740 Integrated RAID Controller with 8GB Cache
2 x Dual Port 10GbE SFP+
2 x i350 Dual Port 1GbE

Ubuntu 20.04 Focal Fossa

Physical Disk:

2 x 240GB - M2
- RAID 1
SAS 12Gbps 512e
Hardware IOPS: 85,000
Recommended IOPS: 3,000

Virtual Disk

240 GB Usable

Logical/Partition Volumes:

OS Drive 240GB

Physical Disk:

3 x 7.15TB Solid State Drive Read Intensive
- RAID 0

Virtual Disk

21 TB Usable

Logical/Partition Volumes:

21TB Usable
- 16TB (/opt)
- 5TB (/data)

LR-NS9500

Ingestion rate:

Max ingestion - 10GB

2 x AMD 7452 32 core CPU
128 vCPU
512 G8 RAM
PERC H745 Integrated RAID Controller with 4GB Cache
2 x Dual Port 10GbE SFP+
2 x Dual Port 10GbE BASE-T
2 x LOM Dual Port 1GbE

Ubuntu 20.04 Focal Fossa

Physical Disk:

2 x 240GB - M2
- RAID 1
SAS 12Gbps 512e
Hardware IOPS: 85,000
Recommended IOPS: 6,000

Virtual Disk

240 GB Usable

Logical/Partition Volumes:

OS Drive 240GB

Physical Disk:

6 x 7.15TB Solid State Drive Read Intensive
- RAID 5

Virtual Disk

35 TB Usable

Logical/Partition Volumes:

35TB Usable
- 27TB (/opt)
- 8TB (/data)

NDR Virtual

Reference Platform	Performance (MPS)	Hardware	Operating System	Disk/Vol 1 Config	Disk/Vol 2 Config
Ingestion and Analytics	Ingestion rate: Max ingestion - 1GB	32 vCPU 64 G8 RAM 10Gb interface for ingestion 10Gb interface for interconnect (Multi-node deployments) 1Gb interface for management	Ubuntu 20.04 Focal Fossa	Virtual Disk: 240 GB Logical/Partition Volumes: OS Drive 240GB	Virtual Disk: 4.6 TB usable Logical/Partition Volumes: 3 TB (/opt) 1.6 TB (/data)
Ingestion and Analytics	Ingestion rate: Max ingestion - 5GB	64 vCPU 256 G8 RAM 10Gb interface for ingestion 10Gb interface for interconnect (Multi-node deployments) 1Gb interface for management	Ubuntu 20.04 Focal Fossa	Virtual Disk: 240 GB - Used for the OS Logical/Partition Volumes: OS Drive 240GB	Virtual Disk: 21 TB usable 3,000 IOPS Logical/Partition Volumes: 16 TB (/opt) 5 TB (/data)
Ingestion and Analytics	Ingestion rate: Max ingestion - 10GB	128 vCPU 512 G8 RAM 10Gb interface for ingestion 10Gb interface for interconnect (Multi-node deployments) 1Gb interface for management	Ubuntu 20.04 Focal Fossa	Virtual Disk: 240 GB - Used for the OS Logical/Partition Volumes: OS Drive 240GB	Virtual Disk: 35 TB usable 6,000 IOPS Logical/Partition Volumes: 27 TB (/opt) 8 TB (/data)

LogRhythm NDR-Supported NIC Cards

1 Gbit

e1000e (RX and TX)
- Supported cards: Intel 8254x/8256x/82571/82572/82573/82574/82583
igb (RX and TX)
- Supported cards: Intel 82575/82576/82580/I210/I350

10 Gbit

ixgbe/ixgbevf (RX and TX)
- Supported cards: Intel 82599/X520/X540/X55x

10/40 Gbit

i40e (RX and TX)
- Supported cards: Intel X710/XL710

10/40/100 Gbit

fm10k (RX and TX)
- Supported cards: FM10420

10/25/50/100 Gbit

ice (RX and TX)
- Supported cards: E810