Determining Your Events per Second

Although the numbers presented in Table 3-3 might not be realistic in your network, they do give you an idea of which types of devices tend to send the most events. The "noisiest" devices on your network are likely in this order:

1 Internet-facing firewalls

2 Other firewalls

3 Intrusion detection systems/intrusion prevention systems (IDS/IPS)

4 Virtual Private Network (VPN) devices

5 Routers

6 Switches

7 Other devices, such as databases, operating systems, antivirus software, desktop and server protection software (such as Cisco Security Agent), and so on

This list of noisiest devices might be completely different from what is found in your environment; it is shown only as an average.

Most organizations already use a syslog server for collecting raw events from security devices. These existing logs can be useful in sizing your CS-MARS deployment.

Begin with your Internet-facing firewalls. To get a rough idea of the EPS being generated, select a log file from your firewalls that spans one or more days. Follow these steps to determine the average EPS from these devices in a 24-hour period:

Step 1 Gather the logs for one or more 24-hour periods.

Step 2 Count the number of lines in the file or files.

Step 3 Divide the number of lines by the number of 24-hour periods the file contains.

Step 4 Divide this number by 86,400.

The number you get will be the average number of EPS in that 24-hour (or longer) period.

The average number of events you calculate provides a good starting point for determining the CS-MARS appliance you need. Understand, though, that you have just calculated a 24hour average instead of an average during peak hours. For a better estimate, look at a snapshot of logs from a busy time of day, or use a tool that can analyze your logs for you and show peak periods. After calculating the number of events for your Internet-facing firewall, calculate the average for your other firewalls and IDSs/IPSs you'll be taking logs from.

NOTE Log files on a syslog server are usually far too large for any text editor to open. The easiest way to count the number of lines in a large file is with the Linux/UNIX command-line tool grep or with the Windows find command.

The grep tool, normally used for searching for text within a file, is simple to use. You can also use the grep tool to display a count of the number of lines that contain a string in a file. In this example, we are searching the file called logfile for the number of lines that contain an empty string. The following syntax matches on every line in the file: grep -c "" logfile

For Windows syslog servers, you can use the find command with the following syntax: find /c /v "someweirdstring" logfile

With find, you are telling Windows to display the count of the number of lines that do not contain the string "someweirdstring".

If you can count all lines in all syslog files for each device you'll be monitoring, this will be the most accurate. However, most organizations don't have these files readily available.

After you've determined the overall average number of EPS, you should attempt to determine your peak event periods, especially if your traffic tends to vary by time of day or day of week.

The same formula used for the overall average can work for hourly averages. Just don't divide by 86,400 if you're looking only at a single hour. There are 60 seconds per minute and 60 minutes per hour. So, if you have a log file with a single hour of data, divide the number of lines by 3600 to reach the average EPS for that period of time.

Continue reading here: Inherent Security of MARS Appliances

Was this article helpful?

+6 0

Readers' Questions

  • gail
    How can i determine for servers what event per second is needed?
    6 months ago
  • To determine the events per second (EPS) that your servers can handle, you need to consider several factors such as the server specifications, workload, and application requirements. Here are some steps to help you calculate the EPS needed for your servers:
    1. Measure current EPS: Start by measuring the current EPS that your servers are processing. This can be done by monitoring server performance metrics such as CPU utilization, memory usage, disk I/O, and network traffic.
    2. Understand workload requirements: Identify the workload requirements of your application or system. This includes the number of events generated per second, the size and complexity of each event, and any processing or storage requirements.
    3. Determine server capacity: Evaluate the capacity of your servers in terms of CPU processing power, memory capacity, disk storage, and network bandwidth. Consider the server specifications, such as the number of CPU cores, amount of RAM, disk type and capacity, and network speed.
    4. Calculate EPS needed: Based on the workload requirements and server capacity, calculate the EPS needed for your servers to handle the incoming events. You can use the formula:EPS needed = (number of events per second) / (server capacity in EPS)
    5. Plan for scalability: Consider future growth and scalability requirements when determining the EPS needed for your servers. It's important to plan for additional capacity to accommodate increasing workload demands.By following these steps and carefully analyzing the server specifications and workload requirements, you can determine the EPS needed for your servers to handle the events effectively and efficiently.
    • heribald
      How to calculate evet per second in server?
      9 months ago
    • To calculate events per second (EPS) on a server, you need to monitor the number of events that occur within a specific time frame. Here's a general approach to calculating EPS:
      1. Determine the observation period: Decide the duration for which you want to measure the EPS. It could be a few seconds, minutes, or even an hour.
      2. Monitor event occurrences: Use a monitoring tool or write a script to count the number of events that occur during the observation period. This depends on the type of events you are interested in, such as server requests, log entries, or database transactions.
      3. Calculate the EPS: Divide the total number of events recorded during the observation period by the duration of that period. For example, if you recorded 1000 events in a 10-second observation period, the calculation would be: EPS = 1000 / 10 = 100 events per second.It's crucial to consider the stability of the server's workload and the resources available when measuring EPS. Also, make sure your monitoring tool or script doesn't significantly impact server performance during the measurement process.
      • bettie hathaway
        How to do events per sec calculation for a month?
        1 year ago
      • To calculate events per second for a month, you need to know the total number of events that occurred in that month and the number of seconds in the month. Here's how you can do it:
        1. Determine the total number of events that occurred in the month. Let's say you have this number, and let's call it "Total Events".
        2. Calculate the total number of seconds in the month. The average number of seconds in a month is 30.44 days multiplied by 24 hours, multiplied by 60 minutes, multiplied by 60 seconds. Let's call this number "Total Seconds".Total Seconds = 30.
        3. 44 * 24 * 60 * 60
        4. Divide the Total Events by the Total Seconds to get the events per second for the month.Events per Second = Total Events / Total Seconds This calculation will give you the average number of events that occurred per second in the given month.
        • danny
          How to check events per second centos?
          1 year ago
          1. Use Grafana and InfluxDB to track your system performance. You can collect and graph the following metrics for your system: CPU, memory, disk, and network I/O usage, system load, and the number of active processes.
          2. Use the "top" command to view the processor load and number of active processes per second.
          3. Use the sar command to collect system performance information. This command can report the number of context switches, interrupts, and disk I/O per second.
          4. Use the vmstat command to view memory and I/O usage. This command can report the number of page-outs and block-ins per second.
          5. Use the netstat command to view network usage. This command can report the number of packets sent and received per second.
          • robur
            How to catch events per second?
            1 year ago
          • It is possible to catch events per second by using event listeners or triggers. Event listeners are functions that “listen” for specific events to happen. When the event occurs, the event listener will be triggered and can then perform some action in response. For example, in JavaScript, you can use the addEventListener() method to listen for a specific event, such as a click on a button, and then perform some action when the event occurs. Triggers allow you to specify how often an event should occur. For example, you can use a trigger to fire a function once per second.
            • eerik
              How much logs does a firewall give?
              1 year ago
            • The amount of logs a firewall will provide can vary greatly depending on its configuration. Most firewalls can be configured to provide detailed logging information, including source and destination IP addresses, the type of traffic being transmitted, the port numbers involved, and the amount of data transferred. Some firewalls can also provide information on user authentication and encryption settings. Additionally, firewall logs can be customized to include additional information, such as the time and date of the connection, the origin of the connection, and the protocol being used.
              • tranquillino
                How can i work out how many server events generated in a day as average?
                1 year ago
              • The best way to work out the average number of server events generated in a day is to use a logging and monitoring system. This will allow you to track the number of incoming requests, events and other metrics. You can then run reports to determine the average number of server events generated on any given day.
                • tony burnett
                  How to check events per second iftop?
                  1 year ago
                • If you want to find out the number of events per second that are passing through an interface, you can use the "iftop" utility. This utility is a command line tool that displays a real-time summary of network traffic passing through an interface. To use it, first install the program with your package manager. Then, run the command "iftop -P" to get a summary of the number of packets and bytes per second that are passing through the interface.
                  • marmaduke
                    How to calculate events per second accuratly?
                    1 year ago
                  • To calculate events per second accurately, you need to measure the average number of events per second over a specific period of time. Start by timing how long it takes for the total number of events to occur. Divide the total number of events by the amount of time it took for them to occur. This will give you the average number of events per second.
                    • Rosita Angelo
                      How to calculate events per second from month global?
                      1 year ago
                    • You can calculate the number of events per second by dividing the total number of events over a given month by the number of seconds in that month. For example, if there were 1,000 events in a given month and the month has 2,592,000 seconds, then the number of events per second would be 0.388. 1,000 / 2,592,000 = 0.388 events per second
                      • Oskar
                        What is Events pers second?
                        1 year ago
                      • Events per second is a measure of the frequency of events or actions that occur over a certain amount of time. It is usually expressed as a number of events per second, or hertz (Hz). For example, a processor that can handle 500 events per second is said to have a frequency of 500 Hz.
                        • Julia
                          Which has the highest Event per second?
                          1 year ago
                        • The event per second with the highest rate is typically found in real-time applications such as streaming video, online gaming, and certain financial trading applications.
                          • lukas
                            How to count number of events in syslog file?
                            1 year ago
                          • You can use the command 'wc -l' to count the number of lines in a syslog file. This will give you the total number of events in the syslog file.
                            • ivy
                              How many events per second for logs in a network?
                              1 year ago
                            • The number of events per second for logs in a network will vary depending on the size and complexity of the network.
                              • christina
                                How to calculate events per second?
                                1 year ago
                              • Events per second (EPS) is calculated by dividing the total number of events that occurred by the length of time it took for those events to occur. To calculate EPS, divide the total number of events that occurred in a given period of time (measured in seconds) by the total length of time of that period. For example, if you had 100 events that occurred over a period of 10 seconds, your EPS would be 10 events per second (100/10).
                                • Adalgisio Baresi
                                  How much Events per second can xsoar received?
                                  1 year ago
                                • Xsoar can receive up to 10,000 events per second.
                                  • layton
                                    How to find total network logs per second?
                                    1 year ago
                                  • It is not possible to determine the total number of network logs per second without more specific information. The network logs in question must be identified, such as web server logs, firewall logs, or router logs, in order to calculate the total number of logs received per second. Additionally, information regarding the size of the network should be provided, as the total number of logs generated per second would depend on the size of the network.
                                    • wilimar
                                      How to calculate eps for a firewall?
                                      1 year ago
                                    • Unfortunately, there is no universal formula to calculate eps (events per second) for a firewall. EPS is a measure of the performance of a firewall, and is determined by testing the firewall with different workloads. To calculate EPS for a particular firewall, it must be tested with a known workload, and the results must be analyzed and compared to the desired performance goals for the specific application.
                                      • ambrogio
                                        How to calulate syslog per second via tcpdump?
                                        1 year ago
                                      • You cannot calculate syslog per second using tcpdump. tcpdump is a packet analyzer mainly used for network troubleshooting and analysis. It captures packets on the network, which can then be analyzed for various purposes. It does not have the ability to calculate syslog per second.