topic Re: Expedition server sizing - increase php memory too! in Expedition Discussions

Expedition server sizing

jwillie3 — Mon, 14 Jan 2019 21:02:31 GMT

Anyone know server sizing requirements for this? Minimum cpu, memory and storage?

Also, what is the recommended way to install?

Re: Expedition server sizing

sjanita — Tue, 22 Jan 2019 03:56:47 GMT

Recommend the following resources for Expedition:

CPU: 4 cores (virtual sockets are ok)

Memory: Min 8 GB, 16 GB if possible

Storage: If you plan to use the machine learning and rule enrichment, add and mount a secondary disk of at least a min of 100 GB. After processing the traffic log files, you should choose to compress or delete the log files if your plans to use the ML annd RE are for weekly or month to month app-ID reconcilliations.

Re: Expedition server sizing

dgildelaig — Thu, 14 Feb 2019 08:51:36 GMT

If we need to increase the Expedition resources, you will have to modify the VM settings and make Expedition aware of the change. To do so, delete the file located at /home/userSpace/environmentParameters.php. (This may be optimized in the future to assist on the correct Expedition's resource tunning)

Re: Expedition server sizing

NateMiles — Thu, 14 Feb 2019 19:57:05 GMT

Thank you very muched.

Worked

Re: Expedition server sizing

johndire77 — Fri, 22 Mar 2019 12:30:53 GMT

i think its belong over 2000...

Re: Expedition server sizing - increase php memory too!

rolinger — Tue, 14 May 2019 13:57:59 GMT

Once you add more memory to the VM and deleted the appropriate file you also need to increase the default memory assigned to php. This also has a drastic impact/improvement on performance - esp with larger projects.

The default is rather low at 128mb. If you increase the VM memory to 4Gb, i would recommend increasing php memroy to 512Gb. if you increase VM memory to 8Gb, then increase php memory to 1Gb. Each will be a sizeable and quite noticeable differences in Expeditions performance:

php.ini is located in:

sudo vi /etc/php/7.0/apache2/php.ini

Find the line 'memory_limit ' and change the value from 128mb to 512mb (or higher)

Re: Expedition server sizing - increase php memory too!

Stevenjwilliams83 — Sat, 29 Jun 2019 20:22:59 GMT

Something to remember though is when assigning resources 1 CPU and either 1G or 2G of ram are dedicated to the OS and are not used by expedition. So 4 vcpu is going to allow 3 to be used by Expedition.

Re: Expedition server sizing

RonaldoRojas — Sun, 20 Oct 2019 02:56:00 GMT

You can find recommended specs here:

https://live.paloaltonetworks.com/t5/Expedition-Articles/New-Expedition-Installation-Procedure/ta-p/275276?attachment-id=8128

And admin guide here:

https://live.paloaltonetworks.com/t5/Expedition-Articles/Expedition-Documentation/ta-p/215619

Re: Expedition server sizing

Stevenjwilliams83 — Tue, 29 Oct 2019 13:46:12 GMT

I wanted to add something here that I thought might be helpful. The recommendation is 100g of space for log exports. The larger my ruleset became the more space each log started taking. I have about 700 rules atm and I can only keep 1 log from each FW in my HA pair. If I forget to process logs (because for some reason automatic log process has never worked for me) your space fills up and you cant actually process the logs due to the fact there is not enough room. I would say 100g is a minimum but keep in mind your environment and how much traffic you have traversing the PAs.

Re: Expedition server sizing

dgildelaig — Tue, 29 Oct 2019 15:15:39 GMT

Thanks Steven for your message, and you are right that it is important to calculate how much space you want to allocate for Expedition logs.

I would recommend that you install the coming update 1.1.43, that may fix the issue about the autoprocessing, and also the afterProcess action for "Compress" or "Delete".