Understanding the Requirements
Key Definitions
Hot Log Storage
Non-archived data that can be accessed for analysis at any time without restoration
Cold Log Storage
Archived data that must be restored before accessing it for analysis
Data Source
Any individual source of logs, including devices, agents, and SaaS integrations
Baseline Assumption
Industry Average: 60 data sources (devices) typically generate approximately 100 GB of monthly data.Your actual data volume may vary based on log verbosity, device types, and monitoring configuration.
Resource Requirements by Deployment Size
The following table shows required resources for one month of hot log storage:- Small Deployment
- Medium Deployment
- Large Deployment
- Enterprise Deployment
50 Data Sources
Hot Log Storage: 120 GB/month| Resource | Requirement |
|---|---|
| CPU Cores | 4 Cores |
| RAM | 16 GB |
| Disk Space | 150 GB |
Ideal for small businesses or branch offices with limited infrastructure
Detailed Requirements Table
| Data Sources | Hot Log Storage | CPU Cores | RAM | Disk Space |
|---|---|---|---|---|
| 50 | 120 GB | 4 Cores | 16 GB | 150 GB |
| 120 | 250 GB | 8 Cores | 16 GB | 250 GB |
| 240 | 500 GB | 16 Cores | 32 GB | 500 GB |
| 500 | 1000 GB | 32 Cores | 64 GB | 1000 GB |
Calculating Your Requirements
You may combine these tiers to allocate resources based on your specific number of devices and desired hot log storage retention.Example Calculation
If you have 180 data sources:Determine Your Scale
180 data sources falls between the Medium (120) and Large (240) deployment tiers.
Interpolate Resources
You would need resources between the two tiers, closer to the Large deployment:
- CPU: 12-16 Cores
- RAM: 24-32 GB
- Disk Space: 350-400 GB
These requirements assume one month of hot log storage. If you need longer retention periods, multiply the disk space requirements accordingly.
Storage Considerations
Hot vs. Cold Storage Strategy
Hot Storage
Use for:
- Recent logs (last 1-3 months)
- Active investigations
- Real-time dashboards
- Frequent searches
- Immediate access
- Higher cost per GB
- Fast query performance
Cold Storage
Use for:
- Historical logs (>3 months)
- Compliance retention
- Infrequent access
- Long-term archival
- Requires restoration
- Lower cost per GB
- Slower access time
Disk Space Planning
When planning disk space:- Hot Storage Period: Decide how many months of hot storage you need (1-3 months typical)
- Growth Buffer: Add 20-30% for unexpected growth
- System Overhead: Reserve space for operating system and UTMStack services
- Archive Strategy: Plan cold storage for compliance and long-term retention
Horizontal Scaling
When to Scale Horizontally
Consider adding secondary nodes when:- You exceed 500 data sources
- Query performance degrades
- You need high availability
- Geographic distribution is required
- You’re an MSP serving multiple clients
Contact UTMStack support for guidance on implementing horizontal scaling for large deployments.
Operating System Requirements
Ubuntu 22.04 LTS
UTMStack is designed and tested for Ubuntu 22.04 LTS (Long Term Support)Why Ubuntu 22.04 LTS?
- Extended support lifecycle
- Stable and well-tested
- Broad hardware compatibility
- Extensive community support
Network Requirements
Bandwidth Considerations
- Inbound Traffic: Sufficient bandwidth to receive logs from all data sources
- Outbound Traffic: Bandwidth for threat intelligence updates and external integrations
- Internal Traffic: Low latency between UTMStack and data sources
Port Requirements
See the Installation Guide for detailed port requirements.Performance Optimization Tips
Use SSD Storage
Use SSD Storage
Solid-state drives (SSDs) significantly improve query performance and data ingestion rates. NVMe SSDs are recommended for large deployments.
Separate Data and System Disks
Separate Data and System Disks
Mount data storage on a separate disk from the operating system to prevent system disk I/O from affecting log ingestion and queries.
Monitor Resource Usage
Monitor Resource Usage
Regularly monitor CPU, RAM, and disk usage to identify when you’re approaching capacity and need to scale.
Optimize Log Collection
Optimize Log Collection
Filter unnecessary logs at the source to reduce ingestion volume and storage requirements without sacrificing security visibility.
Next Steps
Installation Guide
Proceed with installing UTMStack on your sized infrastructure
Quick Start
Get started quickly after installation
Architecture Overview
Learn about UTMStack’s architecture and components
Contact Support
Get help sizing your deployment from UTMStack experts