Expedition server sizing

L0 Member

Expedition server sizing

Anyone know server sizing requirements for this?  Minimum cpu, memory and storage?


Also, what is the recommended way to install?

L4 Transporter

Re: Expedition server sizing

Recommend the following resources for Expedition:


CPU: 4 cores (virtual sockets are ok)

Memory: Min 8 GB, 16 GB if possible

Storage: If you plan to use the machine learning and rule enrichment, add and mount a secondary disk of at least a min of 100 GB. After processing the traffic log files, you should choose to compress or delete the log files if your plans to use the ML annd RE are for weekly or month to month app-ID reconcilliations.



L4 Transporter

Re: Expedition server sizing


If we need to increase the Expedition resources, you will have to modify the VM settings and make Expedition aware of the change. To do so, delete the file located at /home/userSpace/environmentParameters.php. (This may be optimized in the future to assist on the correct Expedition's resource tunning)

L1 Bithead

Re: Expedition server sizing

Thank you very muched.



Senior Security Engineer
L1 Bithead

Re: Expedition server sizing

i think its belong over 2000...

L2 Linker

Re: Expedition server sizing - increase php memory too!

Once you add more memory to the VM and deleted the appropriate file you also need to increase the default memory assigned to php.  This also has a drastic impact/improvement on performance - esp with larger projects.


The default is rather low at 128mb.  If you increase the VM memory to 4Gb, i would recommend increasing php memroy to 512Gb.  if you increase VM memory to 8Gb, then increase php memory to 1Gb.  Each will be a sizeable and quite noticeable differences in Expeditions performance:


php.ini is located in: 

sudo vi /etc/php/7.0/apache2/php.ini

 Find the line 'memory_limit ' and change the value from 128mb to 512mb (or higher)

L3 Networker

Re: Expedition server sizing - increase php memory too!

Something to remember though is when assigning resources 1 CPU and either 1G or 2G of ram are dedicated to the OS and are not used by expedition. So 4 vcpu is going to allow 3 to be used by Expedition. 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!