Determining how many collectors and audit stores to install

Although you can add collectors and audit stores to your audit installation after the initial deployment, you might want to calculate how many you will need before you begin deploying components. You should always have at least two collectors to provide redundancy. As you increase the number of agents deployed, you should consider adding collectors.

Estimate the number of agents and sessions audited

If you plan to use more than the minimum number of collectors, the most important factor to consider is the number of concurrent sessions you expect to monitor on audited computers. The number of concurrent sessions represents the number of agents that are actively capturing user sessions in a site at the same time.

Guidelines for Linux and UNIX computers

You can use the following guidelines as a starting point and adjust after you have observed how much audit data you are collecting and storing for Linux and UNIX computers:

Number of concurrent sessions Recommended number of collectors Recommended number of audit stores

500 (or less) agents

2

1

up to 1000 agents

2

1

more than 1000 agents

2 for every 500 agents

1 for every 1000 agents

Guidelines for Windows computers or mixed environments

You can use the following guidelines as a starting point and adjust after you have observed how much audit data you are collecting and storing for Windows computers:

Number of concurrent sessions Recommended number of collectors Recommended number of audit stores

100 (or less) agents

2

1

more than 100 agents

2 for every 100 agents

1 for every 100 agents

If you auditing Linux, UNIX, and Windows computers, use the numbers of collectors and audit stores recommended for Windows agents unless you have significantly fewer Windows agents.