Help Center/ SecMaster/ Best Practices/ Log Access and Transfer Operation Guide/ Resource Planning
Updated on 2026-06-29 GMT+08:00
View PDF
Share

Resource Planning

Account

A non-administrator IAM account that has the SecMaster data collection management permission.

ECS Specifications

The following table lists the specifications of the tenant cloud server (ECS) where the collector (isap-agent + Logstash) is installed.

Table 1 ECS specifications

vCPUs

Memory

System Disk Size

Data Disk Size

Collector Capacity (Reference)

2 vCPUs

4G

50 GB

100 GB

2000 EPS @ 500B

4

8 GB

50 GB

100 GB

4,000 EPS @ 500 B

8

16 GB

50 GB

100 GB

10,000 EPS @ 500 B

16

32 GB

50 GB

100 GB

20,000 EPS @ 500 B

32

64 GB

50 GB

100 GB

40,000 EPS @ 500 B

64

128 GB

50 GB

100 GB

80,000 EPS @ 500 B

Specifications description:

  • 4000 EPS@500B: The log collector can process 4000 events per second. Condition: The size of an event is 500 bytes.
  • Minimum ECS specifications: vCPUs: 2; Memory: 4 GB; System disk: 50 GB; Data disk: 100 GB.
  • The throughput of a pipeline cannot exceed 4 MB/s. Given an event size of 500 bytes, this corresponds to a processing capacity of 8,000 events per second (EPS).
  • Architecture requirements: Currently, the log collection component controller (isap-agent) can run only on Linux x86 or Arm ECSs. More will be supported in the future.
  • OS (image): Huawei Cloud EulerOS is recommended.
  • The log volume usually increases in proportion to the server specifications. You are advised to increase the log volume based on the specifications in the table. If there is huge pressure on a collector, you can deploy multiple collectors and manage them centrally through collection channels. This can distribute the log forwarding pressure across collectors.

Log Access Limit

No limits. You can enable log access for as many security logs as your resources can handle.