Skip to content
  • There are no suggestions because the search field is empty.

Storage Requirements

Storage Requirements

This section contains all the storage requirements needed to successfully attach storage to your NetWitness Platform deployment host systems. It contains the required drive types, appropriate volumes, and performance IOPS that are needed.

IMPORTANT: For Series 7, Series 6E, MD2412 and MD1400, all drives are all self-encrypting drives. However, encryption should be turned on explicitly by the customer, so that they can own and manage the encryption key.

Drive Specifications

General specifications for core NetWitness Platform Hosts are:

  • IO size 490/Dec
  • Response/Latency < 20ms
  • Decoder 10/90 read/write (low random I/O)
  • Concentrator 50/50 read/write (high random I/O)
  • RAID Group: NL-SAS or 10K SAS
  • Suitable Volumes:

    All Packet Decoder volumes

    All Log Decoder volumes

    All Archiver volumes

    Concentrator meta volume


  • RAID Group: SSD
  • Suitable Volumes: Concentrator index volume

Required NetWitness Platform Storage Volumes

Service Volume Names

  • Service: Network Decoder
  • Volume Name: decoder
  • File Systems Created: packetdb

  • Service: Network Decoder
  • Volume Name: decodersmall
  • File Systems Created: decoder root, index, sessiondb, metadb

  • Service: Log Decoder
  • Volume Name: logdecoder
  • File Systems Created: packetdb

  • Service: Log Decoder
  • Volume Name: logdecodersmall
  • File Systems Created: logdecoder root, index, sessiondb, metadb

  • Service: Concentrator
  • Volume Name: concentrator
  • File Systems Created:

    concentrator root, metadb, sessiondb


  • Service: Concentrator
  • Volume Name: index
  • File Systems Created: index

  • Service:

    Archiver

  • Volume Name:

    archiver

  • File Systems Created:

    database


Volume Sizing

The volume sizes below are automatically created when using the NetWitness Platform storage tool, described in Configure Storage Using the REST API.

  • Volume: decodersmall
  • Filesystem: decoroot
  • Mount Point: /var/netwitness/decoder
  • Size: 10 GB

  • Volume: decodersmall
  • Filesystem: index
  • Mount Point: /var/netwitness/decoder/index
  • Size: 30 GB

  • Volume: decodersmall
  • Filesystem: sessiondb
  • Mount Point: /var/netwitness/decoder/sessiondb
  • Size: 600 GB

  • Volume: decodersmall
  • Filesystem: metadb
  • Mount Point: /var/netwitness/decoder/metadb
  • Size: 100% of free space on
    decodersmall volume

  • Volume: decoder
  • Filesystem: packetdb
  • Mount Point: /var/netwitness/decoder/packetdb
  • Size: 100% of free space on
    decoder volume

  • Volume: logdecodersmall
  • Filesystem: decoroot
  • Mount Point: /var/netwitness/logdecoder
  • Size: 10 GB

  • Volume: logdecodersmall
  • Filesystem: index
  • Mount Point: /var/netwitness/logdecoder/index
  • Size: 30 GB

  • Volume: logdecodersmall
  • Filesystem: sessiondb
  • Mount Point: /var/netwitness/logdecoder/sessiond
  • Size: 600 GB

  • Volume: logdecodersmall
  • Filesystem: metadb
  • Mount Point: /var/netwitness/logdecoder/metadb
  • Size: 100% of free space on logdecodersmall volume

  • Volume: logdecoder
  • Filesystem: packetdb
  • Mount Point: /var/netwitness/logdecoder/packetdb
  • Size: 100% of free space on
    logdecoder volume

  • Volume: concentrator
  • Filesystem: root
  • Mount Point: /var/netwitness/concentrator
  • Size: 30 GB

  • Volume: concentrator
  • Filesystem: sessiondb
  • Mount Point: /var/netwitness/concentrator/sessiondb
  • Size: 10% of free space on concentrator volume

  • Volume: concentrator
  • Filesystem: metadb
  • Mount Point: /var/netwitness/concentrator/metadb
  • Size: 100% of free space on concentrator volume

  • Volume: index
  • Filesystem: index
  • Mount Point: /var/netwitness/concentrator/index
  • Size: 100% of free space on
    index volume

  • Volume: archiver
  • Filesystem: database
  • Mount Point: /var/netwitness/archiver/database
  • Size: 100% of free space on archiver volume

Performance Recommendations

NetWitness recommends that Packet and Log Decoders receive two LUNs or Block Devices, one for Packet data, the other for all other databases. This allows you to segregate the high-bandwidth Packet Database from the other databases so they do not compete for I/O bandwidth with other activity.

Concentrators require a separate SSD-based index volume for best performance. You must house this index volume on a different RAID group than the Concentrator Meta database volume, which you can stored on NL-SAS. Archivers can use a single large NL-SAS storage volume per appliance.

Input/Output Operations Per Second

The following table lists the IOPS requirements for the Decoder and Concentrator hosts.

  • Logs: 10K EPS
  • Log Decoder: 400
  • Concentrator: 8,000

  • Logs: 20K EPS
  • Log Decoder: 550
  • Concentrator: 10,300

  • Logs:

    25K EPS

  • Log Decoder:

    1,200

  • Concentrator:

    10,800


  • Packets: 1Gbps
  • Network Decoder: 600
  • Concentrator: 6,050

  • Packets: 2 Gbps
  • Network Decoder: 950
  • Concentrator: 8,300

  • Packets:

    4 Gbps

  • Network Decoder:

    1,650

  • Concentrator:

    12,800


  • Packets: 6 Gbps
  • Network Decoder: 2,400
  • Concentrator: 17,300

  • Packets:

    8 Gbps

  • Network Decoder:

    3,200

  • Concentrator:

    21,800


General Description of How NetWitness Platform Hosts Store Data

For information about how NetWitness Platform hosts store data, see Appendix A. How NetWitness Platform Hosts Store Data.