Scaling Kaspersky Sandbox

To attain and maintain optimum performance of the Kaspersky Sandbox solution in various conditions, you need to take into account the number of devices on the network, the topology of the network, and the functionality of the solution that you need.

You can choose an optimum configuration of the solution using the following table.

Configurations supported by the Kaspersky Sandbox solution

Physical server configuration	Number of workstations with Kaspersky Endpoint Agent/Kaspersky Endpoint Security	Workload when receiving files via API (objects per hour)
CPU: 4 cores with Hyper-Threading support (8 threads), 2.1 GHz RAM: 32 GB Two hard drives in a RAID 1 array: volume: 600 GB each rotation speed: 10,000 rpm Two network adapters with 1 Gbit/s data transfer rate.	250	75
CPU: 8 cores with Hyper-Threading support (16 threads), 2.2 GHz. RAM: 48 GB Two hard drives in a RAID 1 array: volume: 600 GB each rotation speed: 10,000 rpm Two network adapters with 1 Gbit/s data transfer rate.	500	150
CPU: 12 cores with Hyper-Threading support (24 threads), 2.2 GHz. RAM: 64 GB Two hard drives in a RAID 1 array: volume: 600 GB each rotation speed: 10,000 rpm Two network adapters with 1 Gbit/s data transfer rate.	750	225
CPU: 16 cores with Hyper-Threading support (32 threads), 2.2 GHz. RAM: 64 GB Two hard drives in a RAID 1 array: volume: 600 GB each rotation speed: 10,000 rpm Two network adapters with 1 Gbit/s data transfer rate.	1000	305
CPU: 14 cores with Hyper-Threading support (28 threads), 2.6 GHz. RAM: 64 GB Two hard drives in a RAID 1 array: volume: 600 GB each rotation speed: 10,000 rpm Two network adapters with 1 Gbit/s data transfer rate.	1000	305
2 CPUs: 18 cores with Hyper-Threading support (72 threads), 2.2 GHz RAM: 196 GB Two hard drives in a RAID 1 array: volume: 600 GB each rotation speed: 10,000 rpm Two network adapters with 1 Gbit/s data transfer rate.	5000	910

Example of Kaspersky Sandbox performance:

Physical server configuration:

CPU: 4 cores with Hyper-Threading support (8 threads), 2.1 GHz

RAM: 32 GB

Two hard drives in a RAID 1 array:

volume: 600 GB each
rotation speed: 10,000 rpm
Two network adapters with 1 Gbit/s data transfer rate.

On a server with the specified configuration, Kaspersky Sandbox can:
Process objects received from workstations with Kaspersky Endpoint Security or Kaspersky Endpoint Agent. Maximum number of workstations: 250.
Process objects received from external systems via the API. Maximum objects per hour: 75.

For example, if you want to double the performance of Kaspersky Sandbox (to receive objects from 500 workstations or 150 objects per hour from external systems via the API), you can combine 2 servers into a cluster.

Kaspersky Endpoint Security can be installed on a terminal server, file server, or a network-attached storage (NAS).

If Kaspersky Endpoint Security is installed on a terminal server, the load generated by Kaspersky Endpoint Security is calculated as follows: one Kaspersky Endpoint Security instance on a terminal server serving X users generates the same load as X Kaspersky Endpoint Security instances on a workstation (X users = X Kaspersky Endpoint Security instances).

If Kaspersky Endpoint Security is installed on a file server or a network-attached storage, the load generated by Kaspersky Endpoint Security is calculated as follows: one Kaspersky Endpoint Security instance on a file server or network-attached storage generates the same load as 20 Kaspersky Endpoint Security instances on a workstation.

Virtual machine configuration

The Kaspersky Sandbox application supports the following virtual machine configuration:

CPU: 12 cores (6 sockets, 2 cores each), 2.2 GHz or higher.
RAM: 32 GB.
HDD volume: 600 GB.
Two network adapters with 1 Gbit/s data transfer rate.
Virtual machine settings:

Expose hardware assisted virtualization to the guest OS check box selected.
Latency Sensitivity option set to High.
Entire RAM reserved (32 GB).
Entire CPU clock rate reserved.
You can use the following formula to calculate the entire CPU clock rate: 12 * <clock rate in MHz>.

When configuring the virtual machine, your configuration must match the description above. Only the CPU clock rate can be varied: you can configure a value of 2.2 GHz or higher. If the configuration of your virtual machine deviates from the description above, correct installation and operation of Kaspersky Sandbox is not guaranteed.

Installed on a virtual machine, Kaspersky Sandbox can process objects from up to 250 workstations or 100 objects per hour received using the API.

Page top