Lumu Virtual Appliance - Sizing Guidelines

Sizing Guidelines

Consult the following as a guideline for configuring your Lumu Virtual Appliance (VA) in your environment. Be aware that this may vary depending on several factors related to your network environment, such as overall latency, number of users served by the VA, etc.

The Lumu VA is a virtualized machine running Ubuntu. It contains all the elements required to collect network metadata such as DNS queries, firewall logs, and network flows and sends it in compressed batches to the Lumu cloud to streamline bandwidth consumption. If you are interested in getting started with Lumu VA, access our  Lumu Virtual Appliance  documentation.

Hardware Considerations

These are the minimum virtualized hardware requirements recommended per VA:

  1. Dedicated CPU: 1
  2. RAM: 2GB
  3. Disk space: 10GB
A typical Lumu Virtual Appliance deployed with minimum hardware requirements has a tested throughput of 1200 records per second.

The following tables reference how to configure the VA according to the record load it will handle. The total record load is the average amount of all the different records collected by the appliance per second.

DNS Collector

Consider the following setup as a reference for a Virtual Appliance collecting DNS metadata only:

  Suggested VA Specifications
Threshold (records per second)
 2 CPU, 2 GB RAM
 2000
 4 CPU, 4 GB RAM
 3500
 8 CPU, 8 GB RAM
 6000

Additional Collectors

Consider the following setup as a reference for a Virtual Appliance collecting additional metadata, such as netflow, proxy logs, etc.

Suggested VA Specifications
Threshold (records per second)
 2 CPU, 2 GB RAM
 1000
 4 CPU, 4 GB RAM*
 3000
 4 CPU, 6 GB RAM
 6000
 8 CPU, 8 GB RAM
 12000
* This is the minimum specification recommended for a VA performing netflow collection.
Consider that this sizing guide is mostly based on load testing environments. As a general best practice, assign the lowest resources to each instance according to the expected load and monitor CPU usage.
Recommendation: when the CPU load is continuously over 80%, it is an indicator to jump immediately to a higher setup.

Bandwidth Considerations

The Lumu VA captures network metadata and sends it in compressed batches to the Lumu cloud to streamline bandwidth consumption. While the captured metadata accounts only for a small fraction of the total enterprise traffic, it will always be proportional to the total traffic.

When a VA is used as a DNS collector in high-traffic sites, it is recommended to deploy two virtual appliances to ensure redundancy and use them respectively as primary and secondary DNS collectors across the network. 

If the total bandwidth monitored by the VA is 100Mb/s or more, it is recommended to assign at least 2Mb/s to the link between the VA and the Lumu cloud. This rule reference can help measure the bandwidth for larger or smaller networks.

        • Related Articles

        • Lumu Virtual Appliance

          The Lumu Virtual Appliance (VA) is a pre-configured lightweight virtual machine solution provided by Lumu Technologies to enable the collection of network metadata of your entire enterprise and forward it to the Lumu cloud with the lowest impact on ...
        • Configure Virtual Appliance

          Once the Virtual Appliance (VA) has been added to the Lumu Portal and imported into a hypervisor it is time to configure the Lumu VA to collect network metadata to illuminate threats, attacks, and adversaries coming from your network. If you are ...
        • Deploy on VMware Workstation

          The best way to implement Lumu in your network is to delegate DNS resolution tasks to the Lumu Virtual Appliance (VA). A Lumu Virtual Appliance (VA) is a virtualized machine that provides all the elements required to collect network metadata to ...
        • Deploy on VirtualBox

          The best way to implement Lumu in your network is to delegate DNS resolution tasks to the Lumu Virtual Appliance (VA). A Lumu Virtual Appliance (VA) is a virtualized machine that provides all the elements required to collect network metadata to ...
        • Virtual Appliance Collectors

          The Lumu Virtual Appliance (VA) offers the option to create VA collectors, a seamless way to integrate network metadata, as well as send your DNS logs through the VA instead of using the VA built-in DNS resolver. In this quick guide, we show you how ...