Solved

Server 2008 R2 Auditing - Hardware requirements?

Posted on 2013-02-05
5
656 Views
Last Modified: 2016-11-23
Hi Guys

I'm looking to upgrade a client from Server 2003 to 2008 R2 (or I may use 2012 if it's compatible with their database - database is simple program and does not use sql).
I'll be running 1x server with 2x visualized server installs.
(1x domain controller, 1x terminal server - not running in-house exchange)
Hardware most likely: Dell server box: 2x 2ghz Xeon processors, 24-32GB ram, sas raid0 for OS, sas raid5 for data.

I would like to enable auditing for login's, file access, file changes etc. I'm not sure of the load that Auditing will put on the hardware as I've never used it before.

How much impact should auditing have on my server hardware? Do I need to over budget on the hardware spec? Do I need a separate server box just for auditing?

Any help/pointers would be greatly appreciated.

Kind Regards
Aaron
0
Comment
Question by:moncomp
  • 2
  • 2
5 Comments
 
LVL 47

Expert Comment

by:dlethe
ID: 38857995
RAID0?  No. Totally unacceptable.  RAID1, RAID10, or RAID5/6, or any mix.  Anything but RAID0.

Your bottleneck will be I/O, not CPU or memory.  You have a baseline now, so use it.  I assume auditing is turned off on the client's system.  So exactly what do they have now, and is end-user perspective that it is too slow, just right, or plenty fast.  Run perfmon and look at the I/O queue depth, throughput, and I/Os per second.

You can't make an informed decision on what somebody needs based on what little information you supplied.  Use the end-user's own performance details to be the baseline.
0
 
LVL 1

Expert Comment

by:Sitaram Pamarthi
ID: 38858037
Aaron, In my experience I haven't noticed any significant impact on IO/CPU/Memory when auditing is enabled. It is fairly decent and haven't imposed any problems even on high end systems with SQL and heavy IO.
0
 

Author Comment

by:moncomp
ID: 38858052
Hi dlethe

Thanks for your reply :)
I'll try to answer as best I can.

Currently they have an old 2003 SBS server with 10x users. Auditing is not enabled on that server. Server is currently not overloaded cpu/ram or I/O.
The server is quite old so it will be phased out and a new server will be put in. On the new server the client is asking for auditing to be enabled help track who has accessed what and when. I figure 10x users, small file share, small database share program and no exchange shouldn't require a lot of I/O.

For the new server I was going to use Raid0 for the Hyper-V OS install and then raid5 for the VM machines.

I did not realize that Raid0 for the Hyper-V OS would cause I/O issues.
Would you recommend having Raid1 for the Hyper-V OS or Raid5/6/10? I thought Raid0 had better performance than Raid1 but less redundancy, only if used for the Hyper-V OS (not the VM machines)?

For the VM machine partitions which would you recommend Raid5/6/10, based upon such a small network?

Kind Regards
Aaron
0
 
LVL 47

Accepted Solution

by:
dlethe earned 500 total points
ID: 38858062
I don't recommend RAID0 for anything other than video streaming HDTV or data capture.  If you want speed, then RAID1 is nearly twice as fast as RAID0 in real-world testing on reads.  Why? Because every byte of data is in two places, and the O/S + hardware can load balance.

I also don't recommend RAID5, I go with RAID6 due to the extra redundancy.  Specifically, I prefer RAID6 for database, and a pair of SSDs in a RAID1 configuration for O/S, swap, and scratch table space.  

Auditing is typically statistically insignificant amount of overhead.
0
 

Author Comment

by:moncomp
ID: 38858083
Hi dlethe

That really makes good sense. Thanks for your help :)

Kind Regards
Aaron
0

Featured Post

Best Practices: Disaster Recovery Testing

Besides backup, any IT division should have a disaster recovery plan. You will find a few tips below relating to the development of such a plan and to what issues one should pay special attention in the course of backup planning.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Sometimes drives fill up and we don't know why.  If you don't understand the best way to use the tools available, you may end up being stumped as to why your drive says it's not full when you have no space left!  Here's how you can find out...
This article explains how to install and use the NTBackup utility that comes with Windows Server.
This tutorial will walk an individual through configuring a drive on a Windows Server 2008 to perform shadow copies in order to quickly recover deleted files and folders. Click on Start and then select Computer to view the available drives on the se…
This tutorial will walk an individual through setting the global and backup job media overwrite and protection periods in Backup Exec 2012. Log onto the Backup Exec Central Administration Server. Examine the services. If all or most of them are stop…

860 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question