System requirements for Data Collector
The Data Collector instance must be connected to the internet to collect events on the platform.
Optimal: 4 CPU cores
Minimum: 2 CPU cores
Optimal processor: 16 GB or more of available RAM.
Minimum processor: 8 GB or more of available RAM.
100 GB or more of disk space.
Important: If you manage your partitions, assign the 100 GB of space to the /store partition. The /store directory must be either created on the root file system, which must be large enough to accommodate your Data Collector instance, or you must create a separate /store file system.
|Network adapter||One or more network adapters.|
Data Collector requires the Red Hat® Enterprise Linux® (RHEL) or CentOS Linux V7.x operating system or later. Data Collector creates its own user account called dlc. It doesn't require any other user accounts on the system.
For more information about installing and configuring RHEL or CentOS Linux, see the RHEL documentation (https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/).
If you use a public DNS, and you use a local machine to host your Data Collector, add the IP address and hostname of your Data Collector in the /etc/hosts file on your Linux server. If you do not add the IP address and hostname to /etc/hosts, then your local Data Collector machine is assigned a dynamic IP address.
Inbound firewall ports
The default syslog port must be available and not blocked. You are prompted during the installation to open the port. Port 514 opens for both the User Datagram Protocol (UDP) and the Transport Layer Security over the Transmission Control Protocol (TLS over TCP). This port is forwarded to port 1514 on TCP or UDP so Data Collector can ingest events and forward them to Kafka by using TLS over TCP through port 9194.
If you configure alternate connectors that use a listening port for use with Data Collector, then you must open ports for those connectors above port 1024. Data Collector cannot listen to ports lower than 1024. For example, the default listen port for TLS Syslog is 6514. You configure the listen port when you create a data source.
Outbound firewall ports
If you use an active outbound connector, such as Universal REST API, you must open port 443 on your firewall for outgoing traffic. Data Collector and outbound connectors
You can send and receive many events per second (EPS) on one Data Collector, but the maximum EPS depends on many factors, which include network latency and the processor's CPU cores.
If your processor uses the optimal amount of four CPU cores, one Data Collector can send and receive a maximum of 20,000 EPS. If your processor uses the minimum amount of two CPU cores, one Data Collector can send and receive a maximum of 12,500 EPS.