DeepDiscovery_3.0_Performance Test Report_2012_1H

Deep Discovery3.0Performance Test ReportPerformance Tuning PlanContents1.OBJECTIVES (1)1.1Introduction (1)1.2Objectives (1)2.TEST RESULT (2)2.1Overall Throughput while enable and disable DTAS (2)2.1.1Result from R710 (2)2.1.2Result from R410 (2)2.2Internal TMSP Performance (3)2.2.1Execution Time (3)2.2.2System resource usage (3)2.3Web Console Response Time (4)3.TESTING METHODOLOGY (5)3.1Test Environment and Configuration (5)3.1.1DUT (5)3.1.2Product Configuration (5)3.2Testing Methodology (6)3.3Test Kits (6)3.3.1Tools (6)3.3.2Test profile/sample definition (7)3.4Performance metrics (7)3.4.1System Resource Related Usage (8)3.4.2Product Related Metrics (8)4.ISSUES (9)1.Objectives1.1IntroductionDeep Discovery 3.0 provides the enhancements for user experience on admin console and some new features, such as refining the design of Fstream_serv daemon, applying postgresql database to extend the time of log storage, generating threat correlation report and integrating with the Sandcastle. High performance is always a key index of Deep Discovery. But the new added and enhanced features may degrade or upgrade the performance. So we will test on Deep Discovery 3.0 to figure out its real performance.1.2ObjectivesBelow are the performance objectives of Deep Discovery 3.0.1.Overall system maximum throughput under following situation.a)Enable DTASb)Disable DTAS2.Internal TMSP performance involving correlation, summary and report3.For query operations on the admin consolea)All the widgets on Dashboard should be shown out no longer than 15 seconds.b)Query out the first page in log query shall be within 30 secondsc)All other UI pages should be opened within 5 secondsPerformance Tuning Plan2.Test ResultBelow is the result summary based on our test data.2.1Overall Throughput while enable and disable DTAS2.1.1Result from R7102.1.2Result from R410Note:After investigating the real customer data, the rate of threat file generation is about 0.2/secunder 500Mbps. In our test, we generated the threat file in the rate of 1/sec, 5/sec and 10/secrespectively and the backend traffic is secure.Conclusions:Based on the result above, we can see that:1.For the Maximum throughput of each scenario, there’s not drop if enable DTAS at all.2.The range of the reliable throughput on R710 would be 1Gbps~1.28Gbps, on R410 would be400Mbps~500MbpsThreat Discovery Appliance 2.6 SP12.2Internal TMSP Performance2.2.1Execution Time2.2.2System resource usageConclusions:1.Correlation spends the most of the time, but the total time usage of three daily tasks is not muchmore.2.While the tasks was running, they don’t consume much system resource3.Consider that internal TMSP tasks only start up at midnight, they won’t impact the overallperformance of Deep Discovery.Performance Tuning Plan2.3Web Console Response TimeConclusions:1.All of the widget can be shown out within 15 second based on mass of data in database.2.The time to query out the first page of 30 days raw logs spent a little bit more time but still within ourexpected.Threat Discovery Appliance 2.6 SP13.Testing MethodologyIn this section, we will describe the test scenario that will be covered, and major testing methodology that will be used during the test, including test technology, tools, strategy, samples and metrics.3.1Test Environment and ConfigurationBelow are the general test environment that will be used for our performance testing.3.1.1DUT1. HW Platform:Dell R410Four Intel(R) Xeon(R) CPU E5504 @ 2.00GHz8GB memoryHard disk: 320G2 * Gbps NICs (2 data ports)Dell R710Eight Intel® Xeon® CPU,E5530@2.4GHz8GB memory,Hard disk: 250G8 * Gbps NICs (4 data ports)2. NetworkLAN, 1000Mbps network environmentSwitch: 2 * Cisco 35603.1.2Product ConfigurationBelow is the product configuration.Testing build: 1266ComponentsPerformance Tuning Plan3.2Testing MethodologyFollowing chart is the test topology.Avalanche, acts as a client and a server, can simulate to send out the HTTP traffic. All of the traffic could be mirrored to Deep Discovery for scan. Monitor PC was used to monitor the Deep Discovery resource usage and collect the statistics data after testing.3.3Test KitsBelow are the test tools and test samples that will be used for performance test.3.3.1ToolsTable 3-1 Test ToolsThreat Discovery Appliance 2.6 SP13.3.2Test profile/sample definition∙For Overall Throughput while enable/disable DTAS•Protocol: HTTP 1.1 (persistence) / HTTP 1.0 (non-persistence)•Concurrent Connection: 10k•Sample set:∙For Internal TMSP Performance•Raw data baseline–CAV log: 1000000 records/day * 2 * 30–DAE log: 1000000 records/day * 2 * 30–TMUFE log: 300000 records/day * 2 * 30∙For Web Console Response Time•Data baseline:–CAV log : 9,000,000 (300,000 * 30 days)–DAE log : 9,000,000 (300,000 * 30 days)–TMUFE log : 3,000,000 (100,000 * 30 days)–Aggregated log : 127953 (30 days)–Aggr logs for Geomap (total): 28455•Note:These raw data was exported from a real customer.3.4Performance metricsBesides the performance index, we need to collect more data during test to do performance analysis and check if the result is normal.Performance Tuning Plan3.4.1System Resource Related Usage♦System Level⏹Average CPU usage⏹Memory usage⏹Packet loss⏹Overall Bandwidth3.4.2Product Related Metrics♦Filescan daemon⏹Average CPU usage⏹Average Memory usage♦Fstream_serv daemon⏹Average CPU usage⏹Average Memory usage♦cav log filter (cavd)⏹Average CPU usage⏹Average Memory usage♦tmsyslogd⏹Average CPU usage⏹Average Memory usage⏹I/O estimation (database, /var/log)♦Web console⏹Response TimeThreat Discovery Appliance 2.6 SP14.IssuesN/AProprietary and Secret March 29, 2011 Page 9。