Calculations for the Sandbox component

The hardware requirements for a server with the Sandbox component depend on the type and volume of processed traffic and on the permissible object scan time.

By default, the permissible object scan time is 1 hour. To reduce this time, you need a more powerful server or more servers with the Sandbox component.

It is recommended to calculate the configuration of the Sandbox component as follows:

  1. Install the Central Node and Sensor components on one server and the Sandbox component on a different server for pilot operation of the program.

    To receive sufficient statistical data, the program must process traffic of the organization for a week.

  2. Send the /var/log/kaspersky/apt-history/apt-history.log file, which contains the log of the program, to Kaspersky Lab personnel for analysis.

    If multiple virtual machines are started simultaneously, the speed of processing objects from the queue is increased.

Hardware requirements for the server hosting the Sandbox component

The calculation of the number of servers with the Sandbox component depending on the load is shown in the table below.

Hardware requirements of the Sandbox component depending on the volume of processed traffic

Number of email messages per second

Volume of traffic from SPAN ports (Mbps)

Number of Endpoint Sensors components

Number of additional servers with the Sandbox component

1

200

1000

1

2

500

3000

1

1

1000

5000

1

5

2000

5000

1

20

4000

10000

2

The estimation of the number of Sandbox components is listed for servers with the following configuration:

Page top