best response confirmed by Ralfxyz (Occasional Contributor)


On which of the above machines did you get the health alert?


In general, it's important to understand that the sizing tool is based on heuristics.

It's pretty good most of the times, but we did see anomalies in networks that act a little different.

For example, different mixture of traffic, increased AD events due to lot's of Apps querying AD, or networks with exceptional amounts of AD entities. those and more are issues that the tool can't reasonably measure, so it could be that in some cases you would need to add more memory or cores compared to what the tool says or even mentioned in the table,

Still, for most cases it is a good fit or a good starting point.


As for sizing... the data in the tables is what the sensor itself is consuming.

In addition to that, the sensor resource manager expect to have AT LEAST 15% free RAM and CPU at all times to protect AD services, or else it will throttle itself.

So for example, let's say the sensor needs 10 GB, And AD services / OS need 10 GB more, that's 20GB used RAM at all times.  so in this case, I would use a machine with at least 24 GB of RAM, so at all times I will have a bit more than 15% free, and won't get throttled.

Same goes for total CPU.