My company is quite likely going for the product although we still have
to spec the server.
I have read the documentation and I am wondering what are the best

Preferably we would run the server on the standalone box rather than
virtual. We think we would virtualize the collector and correlation
engine?? Is this the best way?

We would start with 5000EPS license.
In terms of storage , am I right assuming the calculation:
Local event storage (partially compressed): {average byte size per
event} x {number of days} x {events per second} x 0.00008 = Total GB
storage required
600x90x5000x0.00008= 21 TB

The formulas are without any examples.

Many thanks,

malkorkslx's Profile: https://forums.netiq.com/member.php?userid=2711
View this thread: https://forums.netiq.com/showthread.php?t=44969