Sizing Guidelines

Endpoint server capacity is impacted by many factors, including hardware specs, policy configuration, and user activities. In these guidelines, a single data point will be presented and the impact of each factor.

Under given conditions that will explained in detail in later section of this document, an endpoint server can support up to a maximum of:
  • 30,000 seats.
  • 22,500 seats for customers with RAP license.
  • Fingerprint DB that is being downloaded to endpoint client (FPNE) is the most significant of the downloaded resources in size. Number of active policies, and specifically DLib classifiers have a similar yet less significant effect.
  • Enabling RAP increases endpoint server memory consumption.
  • The additional RAP related traffic ingestion by the endpoint server increases CPU usage.
  • For RAP enabled endpoint deployments, 22,500 seats is the maximum capacity for a single endpoint server.
  • The bottleneck for RAP enabled deployment is the endpoint server CPU.
    The following table lists several relevant test elements and the expected effect they could have on performance when increasing or decreasing them.
    Element Name Increase\High value Decrease\Low value
    Bandwidth 10Gbps allows much higher seat count compared to 1Gbps link 1Gbps link can become the bottleneck, effectively limiting seat count
    FPNE size Larger FPNE increases the downloaded endpoint configuration size, increasing bandwidth consumption and endpoint server CPU utilization. Smaller FPNE decreases the downloaded endpoint configuration size, decreasing bandwidth consumption and endpoint server CPU utilization.
    Active policy count More active policies, and DLib classifiers can increase the downloaded endpoint configuration size, increasing bandwidth consumption and endpoint server CPU utilization. Less active policies, and DLib classifiers can decrease the downloaded endpoint configuration size, decreasing bandwidth consumption and endpoint server CPU utilization.
    RAP event rate Higher event rate increases endpoint server CPU utilization, decreasing the maximum supported seats. Lower event rate decreases endpoint server CPU utilization, allowing for more endpoints to connect to the endpoint server.
    Endpoint Server CPU More CPU cores can potentially support more seat, specifically with RAP enabled scenarios Less CPU core limit the number of seat supported by the server.
  • For RAP disabled test, 25,000 seats were tested for a single endpoint server. The bottleneck for the RAP disabled test is the load generator server – 25,000 is the highest tested stable seat count. Endpoint server CPU peaks at 70% during the test, so the estimated absolute maximum capacity can reach up to 30,000 supported.