Scaling Kaspersky Sandbox

To attain and maintain optimum performance of the Kaspersky Sandbox solution in various conditions, you need to take into account the number of devices on the network, the topology of the network, and the functionality of the solution that you need.

You can choose an optimum configuration of the solution using the following table.

Configurations supported by the Kaspersky Sandbox solution

Physical server configuration

Number of Kaspersky Endpoint Agent workstations

Workload when receiving files via API (objects per hour)

CPU: 4 cores with Hyper-Threading support (8 threads), 2.1 GHz

RAM: 32 GB

Two hard drives in a RAID 1 array:

  • volume: 600 GB each
  • rotation speed: 10,000 rpm

    Two network adapters with 1 Gbit/s data transfer rate.

250

75

CPU: 8 cores with Hyper-Threading support (16 threads), 2.2 GHz.

RAM: 48 GB

Two hard drives in a RAID 1 array:

  • volume: 600 GB each
  • rotation speed: 10,000 rpm

    Two network adapters with 1 Gbit/s data transfer rate.

500

150

CPU: 12 cores with Hyper-Threading support (24 threads), 2.2 GHz.

RAM: 64 GB

Two hard drives in a RAID 1 array:

  • volume: 600 GB each
  • rotation speed: 10,000 rpm

    Two network adapters with 1 Gbit/s data transfer rate.

750

225

CPU: 16 cores with Hyper-Threading support (32 threads), 2.2 GHz.

RAM: 64 GB

Two hard drives in a RAID 1 array:

  • volume: 600 GB each
  • rotation speed: 10,000 rpm

    Two network adapters with 1 Gbit/s data transfer rate.

1000

305

CPU: 14 cores with Hyper-Threading support (28 threads), 2.6 GHz.

RAM: 64 GB

Two hard drives in a RAID 1 array:

  • volume: 600 GB each
  • rotation speed: 10,000 rpm

    Two network adapters with 1 Gbit/s data transfer rate.

1000

305

2 CPUs: 18 cores with Hyper-Threading support (72 threads), 2.2 GHz

RAM: 196 GB

Two hard drives in a RAID 1 array:

  • volume: 600 GB each
  • rotation speed: 10,000 rpm

    Two network adapters with 1 Gbit/s data transfer rate.

5000

910

Example of Kaspersky Sandbox performance:

Physical server configuration:

CPU: 4 cores with Hyper-Threading support (8 threads), 2.1 GHz

RAM: 32 GB

Two hard drives in a RAID 1 array:

  • volume: 600 GB each
  • rotation speed: 10,000 rpm

    Two network adapters with 1 Gbit/s data transfer rate.

    On a server with the specified configuration, Kaspersky Sandbox can:

  • Process objects received from Kaspersky Endpoint Agent workstations. Maximum number of workstations: 250.
  • Process objects received from external systems via the API. Maximum objects per hour: 75.

For example, if you want to double the performance of Kaspersky Sandbox (to receive objects from 500 workstations or 150 objects per hour from external systems via the API), you can combine 2 servers into a cluster.

Kaspersky Endpoint Agent can be installed on a terminal server, file server, or a network-attached storage (NAS).

If Kaspersky Endpoint Agent is installed on a terminal server, the load generated by Kaspersky Endpoint Agent is calculated as follows: one Kaspersky Endpoint Agent instance on a terminal server serving X users generates the same load as X Kaspersky Endpoint Agent instances on a workstation (X users = X Kaspersky Endpoint Agent instances).

If Kaspersky Endpoint Agent is installed on a file server or a network-attached storage, the load generated by Kaspersky Endpoint Agent is calculated as follows: one Kaspersky Endpoint Agent instance on a file server or network-attached storage generates the same load as 20 Kaspersky Endpoint Agent instances on a workstation.

Hardware and software requirements of Kaspersky Sandbox virtual machine

Kaspersky Sandbox supports the following virtual machine configuration:

Virtual machine settings:

  1. Expose hardware assisted virtualization to the guest OS check box selected.
  2. Latency Sensitivity option set to High.
  3. Entire RAM reserved (32 GB).
  4. Entire CPU clock rate reserved.

    You can use the following formula to calculate the entire CPU clock rate: 12 * <clock rate in MHz>.

When configuring the virtual machine, your configuration must match the description above. Only the CPU clock rate can be varied: you can configure a value of 2.2 GHz or higher. If the configuration of your virtual machine deviates from the description above, correct installation and operation of Kaspersky Sandbox is not guaranteed.

Installed on a virtual machine, Kaspersky Sandbox can process objects from up to 250 workstations or 100 objects per hour received using the API.

Page top