Scenario

• Suppose a company has 100 Win10 endpoint
• Every employee will boot up their machine at 8am & shutdown at 5pm
• Each employee will run max of 5 apps daily for their job
• Audit-&-Compliance requires all activities from these endpoints to be recorded for 3 months.

Goals & Approach

1. Propose ways to estimate storage sizing for discussion
2. After review & discussion, execute the test plan to achieve the estimates

Proposed Approach

1. Wipe out all data in ODB. Get size of clean ODB with no data.

   var db = orient.getDatabase();
   var size = db.getSize()
   print(size) //in bytes
   

2. Collect logs on a single Win VM for 30 minutes. During the 30 minutes, boot up the machine and run 5 applications i.e. I.E., Chrome, Firefox, Outlook & MS Word.

3. Get size of ODB again. New size - old size is an estimate of how much data 1 Win10 endpoint will generate in 30 minutes. Multiply by 18 to get size of data generated in a day. (9hrs ⇒ 540mins / 30 mins = 18)^^

4. Multiply by 100 to get estimated size of data from 100 Win10 endpoints in a day.

5. 3 months → around 90 days. Multiply by 90 to get estimated size of storage needed to store data from 100 Win10 endpoints for 3 months.

6. Answer from part 5 + size of clean ODB = total storage needed for ODB.

Executing Approach

Size of freshly installed ODB with NO events = 327,126 bytes

Size of ODB after collecting data for 30 mins = 5,243,459 bytes

Size of data generated from 30 mins (inclusive of machine bootup) = 5,243,459 - 327,126 = 4,916,333 bytes

Size of data generated during bootup of machine = 3,000,000 bytes