This page describes general hardware and software requirements for the machines that host Events Service nodes.

General Requirements

  • Determine which version of the Events Service that is compatible with your other platform components.
  • Use a supported Windows 64-bit or Linux 64-bit based operating system supported by the platform. See Platform Requirements.

  • Solid-state drives (SSD) can significantly outperform hard disk drives (HDD), and are therefore recommended for production deployments. Ideally, the disk size should be 1 TB or larger. 
  • The Events Service must run on dedicated machines with identical directory structures, user account profiles, and hardware profiles.
  • For heap space allocation, we recommend allocating half of the available RAM to the Events Service process, with a minimum of 7 GB up to 31 GB.  
  • When testing the events ingestion rate in your environment, it is important to understand that events are batched. Ingestion rates observed at the scale of a minute or two may not reflect the overall ingestion rate. For best results, observe ingestion rate over an extended period of time, several days at least. 
  • Events Service <= 4.5.2 requires Java 8u172.  Events Service >= 23.2.0 requires Java 17; Java 17 is bundled with Events Service >= 23.2.0.
  • Keep the clocks on your application, Controller, and Events Service nodes in sync to ensure consistent event time reporting across the deployment.
  • Your firewall should not block the Events Service REST API port 9080, otherwise, the Enterprise Console will not be able to reach the Events Service remotely.

Hardware Capacity and Resource Planning

When estimating your hardware requirements, the first step is to determine the event ingestion rate (for Transaction Analytics) or the amount of data being indexed (for Log Analytics). This helps you to determine the number of analytics license units you will need.

Once you determine your license units requirements, it is important to consider other factors that affect the hardware capacity, such as the processing load of queries run against the Events Service and the actual type of hardware used. A physical server is likely to perform better than a virtual machine. You should also take into account seasonal or daily spikes in activity in your monitored environment in your considerations. 

An event is the basic unit of data in the events service. In terms of application performance management, a Transaction Analytics event corresponds to a call received at a tier. A business transaction instance that crosses three tiers, therefore, would result in three events being generated. In application performance management metrics, the number of business transaction instances is reflected by the number of calls metric for the overall application. In End User Monitoring, each page view equates to an event, as does each Ajax request, network request, or crash report. 

Events Service Node Sizing Based on License Units

You can plan your hardware requirements with the data in the section. It describes recommended hardware configurations (in the context of Amazon EC2 instance types) corresponding to the number of license entitlement units for Log and Transaction Analytics. See 2024-03-18_22-13-57_License Entitlements and Restrictions for details about license units for Log and Transaction Analytics. 

For additional Events Service sizing information, see the following Cisco AppDynamics Community articles:

The hardware shown for each license amount represents the hardware capacity of a theoretical combined load of both Transaction Analytics and Log Analytics events. The numbers used were derived from actual tests that were performed with an uncombined load, from which the following numbers were extrapolated. Note that the test conditions did not include query load and so may not be representative of a true production analytics environment.

The following table shows sizing recommendations and describes the size of the cluster used for testing. This does not mean you are limited to a seven-node event service. If you need to go beyond seven nodes, contact customer support to ensure proper sizing for your specific environment.

It is to be noted that the retention can be 8, 30, 60 or 90 days which will directly affect storage requirements.

Event TypeAWS Machine Instance Type
i2.2xlarge (61 GB RAM, 8 vCPU, 1600 GB SSD)i2.4xlarge (122 GB RAM, 16 vCPU, 3200 GB SSD)i2.8xlarge (244 GB RAM, 32 vCPU, 6400 GB SSD)
1 node3 nodes5 nodes7 nodes1 node3 nodes5 nodes7 nodes1 node3 nodes5 nodes

Transaction Analytics license units

203744632241841135394120
Log Analytics license units71017191619324439116270

The following points describe the test conditions under which the license units-to-hardware profile mappings in the table were generated: 

  • Average Log event size in bytes: 350
  • Average size of business transaction event: 1 KB
  • Tiers in business transaction: 3 

The tests were conducted on virtual hardware and programmatically generated workload. Real-world workloads may vary. To best estimate your hardware sizing requirements, carefully consider the traffic patterns in your application and test the Events Service in a test environment that closely resembles your production application and user activity.

Minimum Events Service Node Sizing

To configure the Events Service 3 nodes minimum are required.

Database Visibility Events Service Sizing

Database Visibility features use the Events Service for storage. The ingestion capacity and sizing profile for Database Visibility Analytics events are equivalent to that of Log Analytics, with the size of the raw event being about 2 kilobytes on average.

End User Monitoring Events Service Sizing

End User Monitoring includes Analytics-related features that send data to the Events Service.

In End User Monitoring, each page view equates to an event, as does each Ajax request, network request, or crash report. There can be a few dozen Ajax requests for every page load. In general, the ingestion capacity and sizing profile for EUM or Database Visibility Analytics events are equivalent to that for Log Analytics, with the size of the raw events being about 2 kilobytes on average.

To calculate the sizing for EUM, multiply the peak number of browser records in a day by 12 KB. If peak capacity is reached, the Events Service simply starts dropping traffic.

The table below provides details about the memory and storage of different types of browser records. The default retention period is configurable.

Browser Record TypeMemory Requirements Per EventOptionalDefault Retention
BasePage, iFrame, Virtual Page1 KB / 1.5 KB (with sessions enabled)No8 days
Ajax requests1 KBYes
By default, Ajax requests are not stored in the Events Service.