System Requirements

Product Requirements

Minimum

Product	CPU	RAM	Disk
Log360	2 Core	4 GB	50 GB
EventLog Analyzer	8 Core	12 GB *	400 GB **
ADAudit Plus	4 Core	8 GB	50 GB
M365 Manager Plus	4 Core	8 GB	200 GB
UEBA	2 Core	4 GB	40 GB

Additional Information on Eventlog Analyzer Requirements:

^* The RAM requirement varies depending on the log flow rate and the retention settings configured for Elasticsearch (ES).

^** The disk space requirement varies based on the log flow rate and the retention settings configured for Elasticsearch (ES) and Archives.

Recommended

Product	CPU	RAM	Disk
Log360	2 Core	4 GB	50 GB
EventLog Analyzer	20 Core	48 GB *	4 TB **
ADAudit Plus	8 Core	16 GB	100 GB
M365 Manager Plus	6 Core	16 GB	500 GB
UEBA	8 Core	8 GB	100 GB

Additional Information on Eventlog Analyzer Recommendation:

^* The RAM requirement varies based on the log flow rate and the retention settings configured for Elasticsearch (ES). The specified RAM is designed to handle real-time log processing and search operations for up to 2TB of data. For searches spanning multiple days (>2TB of data), the required RAM can be calculated as: (Index Data Size in GB / 60) + 16 GB.

^** The disk space requirement depends on the log flow rate and the retention settings configured for Elasticsearch (ES) and Archives. Disk space is calculated based on a high log flow with a retention period of 1 year for Archives and 32 days for ES.

EventLog Analyzer: https://www.manageengine.com/products/eventlog/system_requirement.html

M365 Manager Plus: https://www.manageengine.com/microsoft-365-management-reporting/system-requirements.html

Active Directory AuditPlus: https://www.manageengine.com/products/active-directory-audit/system-requirements.html

Log360 UEBA: https://www.manageengine.com/log-management/ueba/help/system-requirements.html

General Recommendations

VM infrastructure

• Allocate 100 percent RAM/CPU to the virtual machine running EventLog Analyzer. Sharing memory/CPU with other virtual machines on the same host may result in RAM/CPU starvation and may negatively impact EventLog Analyzer's performance.
• Enabling VM snapshots is not recommended as the host duplicates data in multiple blocks by increasing reads and writes, resulting in increased IO latency and degraded performance.

CPU & RAM

• Server CPU utilization should be maintained below 85% always to ensure optimal performance.
• 50% of server RAM should be kept free for Off-heap utilization of Elasticsearch for optimal performance.

DISK

• Disk latency greatly affects the performance of SIEM solutions. Direct-attached storage(DAS) is recommended on par with an SSD with near zero latency and high throughput. An enterprise SAN can be faster than SSD.

Log360

• Log360 components are resource intensive processes. It is recommended to provide each component with a dedicated server for better performance.
• It is recommended to split the load with Multiple ES Nodes, with Each node handling 800GB - 1.2 TB of Data.
• Log360 uses Elasticsearch, which is expected to utilize off-heap usage for better performance. Off-heap usage is maintained by OS and will free up when necessary.

Additional ES Node Recommendations:

Hardware	Minimum	Recommended
Base Speed	2.4 Ghz	3 Ghz
Core	12	16
RAM	64	64
Disk Space	1.2 TB	1.5 TB
Disk Type	SSD	SSD

Software Requirements

ManageEngine Log360 supports the following Microsoft Windows operating system versions:

• Versions requirements for Evaluation

  Windows 8 & above (or) Windows Server 2012

• Version requirements for Production

  Windows Server 2022/ 2019/ 2016/ 2012 R2/ 2012

Supported Browsers

ManageEngine Log360 requires one of the following browsers to be installed on the system to access the Log360 web client.

• Microsoft Edge
• Firefox 4 and above
• Chrome 10 and above
• Safari 5 and above