My thoughts was regarding an (imaginary) situation where you have (for example): Background: 5 sites with PA-devices (lets say two failover pairs like one pair for external communication such as Internet etc and one for internal communication such as servers etc). Which gives 20 PA-devices in total (5 * 2 * 2 = 20) - (im not sure if the passive unit will be connected to the userid server or not, anyone who knows?). And at the same time 25 locations with two DC's at each location. Which gives 50 DC's in total. Along with 10.000+ users... A simple setup (regarding userid) would then be two userid agent servers per site (for redundancy) which bring you 10 userid agent servers in total. Each PA would then have a list of 10 userid servers (or just 2 from the local site if you need to be gentle with the wan - however the amount of traffic between PA and userid server is far less than between userid server and DC) According to a previous post its reasonable to assume that traffic load between one userid agent server and a DC would yield approx 3Mbit/s (or so) specially with many concurrent users. Because all users can reach all sites each userid agent server must tail ALL the DC servers who exists in this network (50 of them). This means that each userid agent server would have a sustained rate of approx 150Mbit/s (50 * 3Mbit/s = 150), which with 10 of them means you would have a network load of 300Mbit/s per site just for the tailing (and that is if we assume in this calculation that the DC's isnt available on the PA sites otherwise there will be even more traffic). Now... If we instead install one userid agent server (service) on each DC and configure it so it will only tail localhost and nothing more (relation would be 1:1) then yes each PA device would need to connect to 50 userid servers (instead of "just" 10 as previously). However the traffic between each PA and each userid server is far smaller than the "tail -f" which the userid agent must process if the DC isnt installed on the same box. Also if one DC goes down this doesnt matter since this particular userid server will be unavailable BUT this particular userid server only monitored this particular DC (since it was the same box). Which leaves us with the question of how demanding is it to run a userid server service? Since the traffic never goes out on the network it should be a few percent less load on the service itself (less waiting) and since this service also only monitors localhost (and NO remote hosts, perhaps only some exchange server if needed) then the load (I imagine) shouldnt be higher than if you open up the eventviewer on the DC and stare on each row who is flowing by (which should take more resources since the eventviewer draws to the screen which the userid process doesnt really have to 😉 The above is with the assumption that the DC's doesnt replicate the security log between each other which means that each userid server must tail all your DC servers in your network otherwise you will end up with blind spots. Or how can this otherwise be setup (setting higher timeouts isnt an option because this would mean higher probability that wrong user is logged in the PA-device)?
... View more
