Before you deploy a SmartVision appliance to a production environment, make sure that the average events per second (EPS) measured on the appliance does not exceed the recommended maximum EPS.
Important
If the average EPS measured on your Classic edition appliance exceeds the recommended maximum EPS for that model, the appliance may fail to detect some post-exploitation attacker activities. Contact Trellix Technical Support.
This limitation applies to any SmartVision-enabled Network Security Classic edition appliance, whether operating in default mode (with its MVXengine enabled) or operating as a sensor (with its MVX engine disabled).
Recommended maximum EPS rates
The following paragraphs list the recommended maximum EPS rate for each appliance model, grouped by appliance type.
Network Security sensors
This table lists the recommended maximum EPS for SmartVision-enabled Network Security sensors. The average EPS measured on your appliance should not exceed the recommended maximum value for that appliance model.
Network Security integrated appliances
This table lists the recommended maximum EPS for SmartVision-enabled Network Security integrated appliances. The average EPS measured on your appliance should not exceed the recommended maximum EPS for that appliance model.
EPS rates measured on your SmartVision appliance
SmartVision appliances maintain statistics about their events-per-second rates. The statistical values are cumulative since the last time SmartVision was enabled. You can view EPS statistics by using the following CLI command:
show smartvision general-stats
The statistic that you need to check is displayed in the following line of the command output:
Average events per second (x/y/z)
The output displays the following statistical values:
x—The minimum EPS rate sampled.
y—The average of the sampled EPS rates.
z—The maximum EPS rate sampled.
Important
The second value, y, should not exceed the recommended maximum EPS for your appliance.
In the following example, the appliance has processed three events per second on average since the last time was enabled:
hostname # show smartvision general-stats General statistics: . . . Current events per second 0 Average events per second (0/3/188) . . .
Prerequisites
The SmartVision-enabled sensor or integrated appliance is installed in its intended location. See SmartVision appliance placement and operational mode.
SmartVision monitoring has run for at least 24 hours. This allows to gather meaningful statistics.
Admin, Analyst, Monitor, or Operator access to the appliance.
View the average EPS measured by SmartVision on your appliance.
Run the
show smartvision general-statscommand. The second of the three numbers displayed in the Average events per second line is the average EPS measured since SmartVision was enabled.In the following example, the appliance processed three events per second on average since SmartVision was enabled:
hostname # show smartvision general-stats General statistics: . . . Current events per second 0 Average events per second (0/3/188) . . .
Compare the average EPS measured on your appliance against the recommended maximum EPS for that appliance model. The recommended maximum rates are provided in Recommended maximum EPS rates.
If the average EPS measured on your appliance is below the recommended maximum EPS for that model, you can operate this appliance in a SmartVision deployment.
If the average EPS measured on your Classic edition appliance exceeds the recommended maximum EPS for that model, the appliance may fail to detect some post-exploitation attacker activities. Contact Trellix Technical Support.