Demo Performance & Sizing

The page describes to environment used to perform the auditing for the demo, and the performance metrics observed. Core Audit performance depends on the activity volume, so providing actual metrics for a known volume (that can be seen in the Online Demo) can help estimate the performance on your systems.

Environment

The Online Demo was recorded with 3 machines:
1) An HP desktop PC with an AMD-A8 (quad core) 1.9Ghz CPU running Windows 8. This PC was running:
  • The Core Audit Server
  • Oracle 11g that was audited (Windows-11g repository)
  • 32bit Linux virtual machine running Oracle 10g that was audited (Linux32-10g repository)
  • 64bit Linux virtual machine running Oracle 11g that was audited (Linux64-11g repository)
  • The CCAPP and HRAPP demo applications that connected to all 5 databases in the demo
2) A Solaris SPARC server running Oracle 10g (Solaris-10g repository). This machine was on the same 100mbit LAN as the Core Audit Server.
3) An AIX PowerPC running Oracle 11g (AIX-11g repository). This machine was connected to the Core Audit Server via a WAN (over the internet).

SQL Load

While the same client connected to all the databases, different loads were generated because of the network bandwidth and delays. The observed loads were:
  • AIX-11g – 1,400 SQLs/5min (Lower activity volume due to WAN round trip)
  • Linux32-10g – 6,000-7,000 SQLs/5min
  • Linux64-11g – 6,000-7,000 SQLs/5min
  • Solaris-10g – 5,000-6,000 SQLs/5min
  • Windows-11g – 7,000-8,000 SQLs/5min
The load was performed over two days:
  • January 14, 2013 – Reference time. Load for 3.5 hours (1pm – 4:30pm)
  • January 15, 2013 – Load plus attacks. over 6 hours (11:30am – 5:45pm)
The bottom line is a SQL load of about 5,500 SQLs/min for almost 10 hours.

Core Audit Server Proformance

Core Audit Server CPU usage never went above 1% (mostly around 0.5%). Since the Audit Server machine was also running 2 virtual machines and 3 Oracle databases, it is important to note that the system never reached 100% utilization (was mostly around 60%)
Core Audit Server memory consumption (for all 5 databases) ranged between 12-15 MB (Memory usage for the Core Audit Server shown in task manager)
Core Audit Server network consumption for all 5 databases was less than 0.5 mbit/sec.
Total Disk usage for all repositories was 58 MB. The breakdown is:
  • AIX-11g – 2.8 MB
  • Linux32-10g – 4.3 MB
  • Linux64-11g – 5.8 MB
  • Solaris-10g – 26.4 MB (High usage due to the Everything policy that recorded every SQL)
  • Windows-11g – 18.6 MB
The security repository consumed between 0.3 – 0.7 MB per instance

Core Audit Agent Performance

Agent performance was measured by CPU utilization of the agent on the audited database servers:
  • AIX-11g – Ranging between 0.2% – 2.5%
  • Linux32-10g – Ranging between 0.3% – 0.7%
  • Linux64-11g – Ranging between 0.3% – 1.7%
  • Solaris-10g – Ranging between 0% – 0.1%
  • Windows-11g – Ranging between 0% – 0.1%