IWSVA and ARM has different sizing guides and you wanted to know which one to follow if IWSVA is integrated with ARM.
You need to follow the ARM sizing guide when IWSVA is integrated with ARM.
There are no existing recommended settings for hard disk drive allocations when IWSVA is integrated with ARM. The previous recommendation of having a large disk space (300GB) is for log-intensive environments and does not include instances wherein debugging to troubleshoot a technical support issue is required.
IWSVA has the following requirements:
- Dual 2.8 GHz Intel Core2Duo 64-bit processor or equivalent for up to 4000 users
- Dual 3.16 GHz Intel QuadCore(TM) 64-bit processor or equivalent for up to 9500 users
- 4GB RAM is recommended to support up to 4000 users
- 8GB RAM is recommended to support up to 9500 users
- 300GB of disk space or more for log intensive environments
IWSVA automatically partitions the detected disk space according to the recommended Linux practices. Furthermore, implementing IWSVA in a medium to large enterprise environments should utilize Trend Micro Advanced Reporting and Management (ARM) for centralized database functionality.
When IWSVA is integrated with ARM, most of the logging and reporting functions are exported to ARM and not to IWSVA. Offloading logging and reporting to an off-box device will improve the logging and reporting performance and will reduce the scanning latency on the IWSVA unit.
If an IWSVA installation that is integrated with ARM consumes a lot of disk space, it is recommended to isolate the issue to find the root cause of a full hard disk and to determine the files that take up such a large space. Finally, it is recommended to take the corrective actions based on the given environment.
These activities include the following:
- Disable access or debug logs
- Do not gather performance data
- Write logs to database only
For IWSVA version 5.5, customers can download this sizing document as a baseline.
For your reference:
You can download the IWSVA installer on this link: InterScan Web Security Virtual Appliance: All Versions
You can download the ARM installer on this link: Advanced Reporting and Management for InterScan Web Security: All Versions
If you are not sure why IWSVA, when integrated with ARM, is taking up so much disk space, please contact Trend Micro Technical Support for further assistance