
9
Overload
If a server is overloaded (e.g., we connect 20,000 clients to a server only able to service 10,000 clients at an interval of
every 10 minutes) it will skip some of the clients connected. On average every second client connection will be serviced, as
if the client connection interval were set to 20 minutes instead of 10 minutes. Every service denial will be logged as follows:
"<SERVERMGR_WARNING> ServerThread: maximum number of threads for active connections reached (500), the server will skip
this connection”. Service denials may also occur during temporary server overloads.
You can change the value under the Maximum number of active connections (the default is 500) in the advanced server
settings, but we recommend to do so only in exceptional cases (e.g. when solving specific issues). Should there be an
overabundance of system resources and database engine performance you can use this setting to adjust the overall server
performance.
Data transfer over a network
During a server's standard operation, we can estimate a client connecting every 10 minutes will report 0.04 events per
connection, which is 1 event reported every 4 hours per client. This will produce ~2 kilobytes of traffic per connection.
In a virus outbreak scenario, with a client reporting 7 events every time it connects traffic may increase up to 240 kilobytes
per connection. If you use compression (default) the data transferred will be approximately 50% smaller in size, i.e. about
120 kilobytes per connection.
The data includes direct client connections, omitting replicated connections. Replication occurs much less often and serves
to send new events from lower servers. Events to be automatically replicated and their verbosity level can be configured in
the advanced settings of the server (under Tools > Server Options > Advanced > Edit Advanced Settings > Replication
). In the Server maintenance section you can configure the maximum level of logs, that the upper server will accept - this
setting applies to both directly connecting clients and replicated clients.
Storage capacity requirements
Clean installation of the product with an MS Access database takes up to 60 MB of disk space.
Most of the storage space is taken up by client events, that are stored in the database and to a repository on the disk
(default directory is C:\Documents and Settings\All Users\Application Data\Eset\ESET Remote Administrator\Server). ERA
requires that at least 5% of the disk be free. If this minimum is exceeded the server will stop receiving some of the client
events. This setting can be found under Tools > Server Options > Advanced > Edit Advanced Settings > Advanced >
Maximum disk space usage. Approximately 10GB per 1000 clients of free disk space is required for regular operation
under the default cleanup settings (deleting events older than 3 months).
Case study
A server using an MS Access database that has clients connecting to it every 5 minutes and reporting 7 events (e.g. threat
log, event log, scan log, configuration change etc.) per connection in average can temporarily service up to 3000 clients.
This scenario depicts a temporary overload situation, such as reporting during a virus outbreak etc.
If the server uses an external MySQL database and the client connection interval is set to 10 minutes (generating 0.02
events per connection) the maximum number of clients the server will be able to service increases to 30,000. Such a
scenario exhibits optimal database performance, with clients reporting a relatively small number of events.
In regular operation, using an MS Access database and a client connection interval of 10 minutes enables the server to
service a maximum of 10,000 clients.
2.1.3 Ports used
The chart below lists the possible network communications used when ERAS is installed. The process EHttpSrv.exe listens
on TCP port 2221 and the process era.exe listens on TCP ports 2222, 2223, 2224 and 2846. Other communications occur using
native operating system processes (e.g., ”NetBIOS over TCP/IP”).
Default port used by the Mirror feature integrated in ERAS (HTTP version)
Communication between clients and ERAS
Communication between ERAC and ERAS
If all the program features are in use, the following network ports need to be open:
Communication between the agent einstaller.exe and
ERAS during remote install
139 (target port from the point of view of ERAS)
Copying of the agent einstaller.exe from ERAS to
a client using the share admin$
Comentarios a estos manuales