SOLVED

Azure ATP sizing

%3CLINGO-SUB%20id%3D%22lingo-sub-1078185%22%20slang%3D%22en-US%22%3EAzure%20ATP%20sizing%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1078185%22%20slang%3D%22en-US%22%3E%3CP%3EI%20recently%20set%20up%20the%20RAM%20as%20recommended%20by%20the%20sizing%20tool%2C%20but%20now%20I%20get%20the%20message%20again%20in%20Azure%20ATP%20%22some%20network%20traffic%20is%20not%20being%20analyzed%22.%3C%2FP%3E%3CP%3ECurrently%20the%20tool%20shows%20the%20following%3A%3CBR%20%2F%3E%3CBR%20%2F%3E%3C%2FP%3E%3CTABLE%3E%3CTBODY%3E%3CTR%3E%3CTD%3EDC%3C%2FTD%3E%3CTD%3ESensor%20Supported%3C%2FTD%3E%3CTD%3EFailed%20Samples%3C%2FTD%3E%3CTD%3EMax%20Packets%2Fsec%3C%2FTD%3E%3CTD%3EAvg%20Packets%2Fsec%3C%2FTD%3E%3CTD%3EBusy%20Packets%2Fsec%3C%2FTD%3E%3CTD%3EBusy%20Packets%2Fsec%20Start%20Time%3C%2FTD%3E%3CTD%3EBusy%20Packets%2Fsec%20End%20Time%3C%2FTD%3E%3CTD%3EMin%20Avail%20MB%3C%2FTD%3E%3CTD%3EAvg%20Avail%20MB%3C%2FTD%3E%3CTD%3EBusy%20Avail%20MB%3C%2FTD%3E%3CTD%3EBusy%20RAM%20Start%20Time%3C%2FTD%3E%3CTD%3EBusy%20RAM%20End%20Time%3C%2FTD%3E%3CTD%3ETotal%20MB%3C%2FTD%3E%3CTD%3EMax%20%25%20CPU%20Time%3C%2FTD%3E%3CTD%3EAvg%20%25%20CPU%20Time%3C%2FTD%3E%3CTD%3EBusy%20%25%20CPU%20Time%3C%2FTD%3E%3CTD%3EBusy%20CPU%20Start%20Time%3C%2FTD%3E%3CTD%3EBusy%20CPU%20End%20Time%3C%2FTD%3E%3CTD%3ELogical%20processors%3C%2FTD%3E%3CTD%3EProcessor%20Groups%3C%2FTD%3E%3CTD%3ECore%20Count%3C%2FTD%3E%3CTD%3EVM%20Indicator%3C%2FTD%3E%3CTD%3EAD%20Site%3C%2FTD%3E%3CTD%3ETime%20Zone%20Name%3C%2FTD%3E%3CTD%3EIs%20DST%3C%2FTD%3E%3CTD%3EOS%20Caption%3C%2FTD%3E%3CTD%3EOS%20Build%20Number%3C%2FTD%3E%3CTD%3EOS%20Installation%20Type%3C%2FTD%3E%3CTD%3EOS%20Server%20Levels%3C%2FTD%3E%3C%2FTR%3E%3CTR%3E%3CTD%3EsrvRODC1.contoso.com%3C%2FTD%3E%3CTD%3EYes%2C%20but%20additional%20resources%20required%3A%20%2B2GB%3C%2FTD%3E%3CTD%3E0%3C%2FTD%3E%3CTD%3E2.438%3C%2FTD%3E%3CTD%3E55%3C%2FTD%3E%3CTD%3E111%3C%2FTD%3E%3CTD%3E08%3A17%3A54%3C%2FTD%3E%3CTD%3E08%3A32%3A51%3C%2FTD%3E%3CTD%3E1.833%3C%2FTD%3E%3CTD%3E2.081%3C%2FTD%3E%3CTD%3E2.040%3C%2FTD%3E%3CTD%3E07%3A15%3A54%3C%2FTD%3E%3CTD%3E07%3A30%3A57%3C%2FTD%3E%3CTD%3E4.095%3C%2FTD%3E%3CTD%3E89%3C%2FTD%3E%3CTD%3E8%3C%2FTD%3E%3CTD%3E13%3C%2FTD%3E%3CTD%3E07%3A20%3A04%3C%2FTD%3E%3CTD%3E07%3A35%3A07%3C%2FTD%3E%3CTD%3E2%3C%2FTD%3E%3CTD%3E1%3C%2FTD%3E%3CTD%3E2%3C%2FTD%3E%3CTD%3EVMWare%3C%2FTD%3E%3CTD%3ELondon%3C%2FTD%3E%3CTD%3E(UTC%2B01%3A00)%20Amsterdam%2C%20Berlin%2C%20Bern%2C%20Rome%2C%20Stockholm%2C%20Vienna%3C%2FTD%3E%3CTD%3EFalse%3C%2FTD%3E%3CTD%3EMicrosoft%20Windows%20Server%202016%20Standard%3C%2FTD%3E%3CTD%3E14393%3C%2FTD%3E%3CTD%3EServer%20Core%3C%2FTD%3E%3CTD%3EServerCore%3C%2FTD%3E%3C%2FTR%3E%3CTR%3E%3CTD%3EsrvRODC2.contoso.com%3C%2FTD%3E%3CTD%3EYes%2C%20but%20additional%20resources%20required%3A%20%2B3GB%3C%2FTD%3E%3CTD%3E0%3C%2FTD%3E%3CTD%3E1.940%3C%2FTD%3E%3CTD%3E63%3C%2FTD%3E%3CTD%3E94%3C%2FTD%3E%3CTD%3E08%3A21%3A09%3C%2FTD%3E%3CTD%3E08%3A36%3A12%3C%2FTD%3E%3CTD%3E534%3C%2FTD%3E%3CTD%3E1.188%3C%2FTD%3E%3CTD%3E1.153%3C%2FTD%3E%3CTD%3E06%3A23%3A16%3C%2FTD%3E%3CTD%3E06%3A38%3A13%3C%2FTD%3E%3CTD%3E4.095%3C%2FTD%3E%3CTD%3E100%3C%2FTD%3E%3CTD%3E11%3C%2FTD%3E%3CTD%3E14%3C%2FTD%3E%3CTD%3E07%3A17%3A54%3C%2FTD%3E%3CTD%3E07%3A32%3A57%3C%2FTD%3E%3CTD%3E2%3C%2FTD%3E%3CTD%3E1%3C%2FTD%3E%3CTD%3E2%3C%2FTD%3E%3CTD%3EVMWare%3C%2FTD%3E%3CTD%3ELyon%3C%2FTD%3E%3CTD%3E(UTC%2B01%3A00)%20Amsterdam%2C%20Berlin%2C%20Bern%2C%20Rome%2C%20Stockholm%2C%20Vienna%3C%2FTD%3E%3CTD%3EFalse%3C%2FTD%3E%3CTD%3EMicrosoft%20Windows%20Server%202016%20Standard%3C%2FTD%3E%3CTD%3E14393%3C%2FTD%3E%3CTD%3EServer%20Core%3C%2FTD%3E%3CTD%3EServerCore%3C%2FTD%3E%3C%2FTR%3E%3CTR%3E%3CTD%3EsrvRODC3.contoso.com%3C%2FTD%3E%3CTD%3EYes%2C%20but%20additional%20resources%20required%3A%20%2B3GB%3C%2FTD%3E%3CTD%3E0%3C%2FTD%3E%3CTD%3E2.237%3C%2FTD%3E%3CTD%3E173%3C%2FTD%3E%3CTD%3E229%3C%2FTD%3E%3CTD%3E07%3A19%3A15%3C%2FTD%3E%3CTD%3E07%3A34%3A18%3C%2FTD%3E%3CTD%3E600%3C%2FTD%3E%3CTD%3E929%3C%2FTD%3E%3CTD%3E907%3C%2FTD%3E%3CTD%3E07%3A26%3A21%3C%2FTD%3E%3CTD%3E07%3A41%3A18%3C%2FTD%3E%3CTD%3E3.071%3C%2FTD%3E%3CTD%3E100%3C%2FTD%3E%3CTD%3E10%3C%2FTD%3E%3CTD%3E14%3C%2FTD%3E%3CTD%3E07%3A20%3A00%3C%2FTD%3E%3CTD%3E07%3A35%3A02%3C%2FTD%3E%3CTD%3E2%3C%2FTD%3E%3CTD%3E1%3C%2FTD%3E%3CTD%3E2%3C%2FTD%3E%3CTD%3EVMWare%3C%2FTD%3E%3CTD%3EPune%3C%2FTD%3E%3CTD%3E(UTC%2B01%3A00)%20Amsterdam%2C%20Berlin%2C%20Bern%2C%20Rome%2C%20Stockholm%2C%20Vienna%3C%2FTD%3E%3CTD%3EFalse%3C%2FTD%3E%3CTD%3EMicrosoft%20Windows%20Server%202016%20Standard%3C%2FTD%3E%3CTD%3E14393%3C%2FTD%3E%3CTD%3EServer%20Core%3C%2FTD%3E%3CTD%3EServerCore%3C%2FTD%3E%3C%2FTR%3E%3CTR%3E%3CTD%3EsrvRODC4.contoso.com%3C%2FTD%3E%3CTD%3EYes%2C%20but%20additional%20resources%20required%3A%20%2B3GB%3C%2FTD%3E%3CTD%3E0%3C%2FTD%3E%3CTD%3E4.109%3C%2FTD%3E%3CTD%3E62%3C%2FTD%3E%3CTD%3E94%3C%2FTD%3E%3CTD%3E07%3A16%3A34%3C%2FTD%3E%3CTD%3E07%3A31%3A37%3C%2FTD%3E%3CTD%3E633%3C%2FTD%3E%3CTD%3E924%3C%2FTD%3E%3CTD%3E899%3C%2FTD%3E%3CTD%3E06%3A46%3A40%3C%2FTD%3E%3CTD%3E07%3A01%3A37%3C%2FTD%3E%3CTD%3E4.095%3C%2FTD%3E%3CTD%3E100%3C%2FTD%3E%3CTD%3E36%3C%2FTD%3E%3CTD%3E41%3C%2FTD%3E%3CTD%3E06%3A23%3A21%3C%2FTD%3E%3CTD%3E06%3A38%3A19%3C%2FTD%3E%3CTD%3E2%3C%2FTD%3E%3CTD%3E1%3C%2FTD%3E%3CTD%3E2%3C%2FTD%3E%3CTD%3EVMWare%3C%2FTD%3E%3CTD%3ERom%3C%2FTD%3E%3CTD%3E(UTC%2B01%3A00)%20Amsterdam%2C%20Berlin%2C%20Bern%2C%20Rome%2C%20Stockholm%2C%20Vienna%3C%2FTD%3E%3CTD%3EFalse%3C%2FTD%3E%3CTD%3EMicrosoft%20Windows%20Server%202016%20Standard%3C%2FTD%3E%3CTD%3E14393%3C%2FTD%3E%3CTD%3EServer%20Core%3C%2FTD%3E%3CTD%3EServerCore%3C%2FTD%3E%3C%2FTR%3E%3CTR%3E%3CTD%3Esrvdc3.contoso.com%3C%2FTD%3E%3CTD%3EYes%2C%20but%20additional%20resources%20required%3A%20%2B1GB%3C%2FTD%3E%3CTD%3E0%3C%2FTD%3E%3CTD%3E13.915%3C%2FTD%3E%3CTD%3E3.425%3C%2FTD%3E%3CTD%3E4.296%3C%2FTD%3E%3CTD%3E07%3A32%3A12%3C%2FTD%3E%3CTD%3E07%3A47%3A09%3C%2FTD%3E%3CTD%3E7.378%3C%2FTD%3E%3CTD%3E7.987%3C%2FTD%3E%3CTD%3E7.896%3C%2FTD%3E%3CTD%3E08%3A21%3A54%3C%2FTD%3E%3CTD%3E08%3A36%3A57%3C%2FTD%3E%3CTD%3E12.287%3C%2FTD%3E%3CTD%3E100%3C%2FTD%3E%3CTD%3E30%3C%2FTD%3E%3CTD%3E42%3C%2FTD%3E%3CTD%3E08%3A11%3A18%3C%2FTD%3E%3CTD%3E08%3A26%3A16%3C%2FTD%3E%3CTD%3E4%3C%2FTD%3E%3CTD%3E1%3C%2FTD%3E%3CTD%3E4%3C%2FTD%3E%3CTD%3EVMWare%3C%2FTD%3E%3CTD%3EBerlin%3C%2FTD%3E%3CTD%3E(UTC%2B01%3A00)%20Amsterdam%2C%20Berlin%2C%20Bern%2C%20Rome%2C%20Stockholm%2C%20Vienna%3C%2FTD%3E%3CTD%3EFalse%3C%2FTD%3E%3CTD%3EMicrosoft%20Windows%20Server%202016%20Standard%3C%2FTD%3E%3CTD%3E14393%3C%2FTD%3E%3CTD%3EServer%20Core%3C%2FTD%3E%3CTD%3EServerCore%3C%2FTD%3E%3C%2FTR%3E%3CTR%3E%3CTD%3Esrvdc2.contoso.com%3C%2FTD%3E%3CTD%3EYes%2C%20but%20additional%20resources%20required%3A%20%2B1GB%3C%2FTD%3E%3CTD%3E0%3C%2FTD%3E%3CTD%3E9.664%3C%2FTD%3E%3CTD%3E3.934%3C%2FTD%3E%3CTD%3E4.506%3C%2FTD%3E%3CTD%3E07%3A38%3A18%3C%2FTD%3E%3CTD%3E07%3A53%3A15%3C%2FTD%3E%3CTD%3E7.062%3C%2FTD%3E%3CTD%3E7.613%3C%2FTD%3E%3CTD%3E7.552%3C%2FTD%3E%3CTD%3E07%3A52%3A30%3C%2FTD%3E%3CTD%3E08%3A07%3A27%3C%2FTD%3E%3CTD%3E12.287%3C%2FTD%3E%3CTD%3E91%3C%2FTD%3E%3CTD%3E24%3C%2FTD%3E%3CTD%3E47%3C%2FTD%3E%3CTD%3E08%3A33%3A18%3C%2FTD%3E%3CTD%3E08%3A48%3A19%3C%2FTD%3E%3CTD%3E4%3C%2FTD%3E%3CTD%3E1%3C%2FTD%3E%3CTD%3E4%3C%2FTD%3E%3CTD%3EVMWare%3C%2FTD%3E%3CTD%3EBerlin%3C%2FTD%3E%3CTD%3E(UTC%2B01%3A00)%20Amsterdam%2C%20Berlin%2C%20Bern%2C%20Rome%2C%20Stockholm%2C%20Vienna%3C%2FTD%3E%3CTD%3EFalse%3C%2FTD%3E%3CTD%3EMicrosoft%20Windows%20Server%202016%20Standard%3C%2FTD%3E%3CTD%3E14393%3C%2FTD%3E%3CTD%3EServer%20Core%3C%2FTD%3E%3CTD%3EServerCore%3C%2FTD%3E%3C%2FTR%3E%3CTR%3E%3CTD%3Esrvdc1.contoso.com%3C%2FTD%3E%3CTD%3EYes%2C%20but%20additional%20resources%20required%3A%20%2B1GB%3C%2FTD%3E%3CTD%3E0%3C%2FTD%3E%3CTD%3E12.198%3C%2FTD%3E%3CTD%3E4.356%3C%2FTD%3E%3CTD%3E5.565%3C%2FTD%3E%3CTD%3E07%3A55%3A30%3C%2FTD%3E%3CTD%3E08%3A10%3A27%3C%2FTD%3E%3CTD%3E7.311%3C%2FTD%3E%3CTD%3E7.843%3C%2FTD%3E%3CTD%3E7.635%3C%2FTD%3E%3CTD%3E08%3A15%3A38%3C%2FTD%3E%3CTD%3E08%3A30%3A35%3C%2FTD%3E%3CTD%3E12.287%3C%2FTD%3E%3CTD%3E76%3C%2FTD%3E%3CTD%3E17%3C%2FTD%3E%3CTD%3E25%3C%2FTD%3E%3CTD%3E08%3A01%3A41%3C%2FTD%3E%3CTD%3E08%3A16%3A38%3C%2FTD%3E%3CTD%3E4%3C%2FTD%3E%3CTD%3E1%3C%2FTD%3E%3CTD%3E4%3C%2FTD%3E%3CTD%3EVMWare%3C%2FTD%3E%3CTD%3EMuenchen%3C%2FTD%3E%3CTD%3E(UTC%2B01%3A00)%20Amsterdam%2C%20Berlin%2C%20Bern%2C%20Rome%2C%20Stockholm%2C%20Vienna%3C%2FTD%3E%3CTD%3EFalse%3C%2FTD%3E%3CTD%3EMicrosoft%20Windows%20Server%202016%20Standard%3C%2FTD%3E%3CTD%3E14393%3C%2FTD%3E%3CTD%3EServer%20Core%3C%2FTD%3E%3CTD%3EServerCore%3C%2FTD%3E%3C%2FTR%3E%3CTR%3E%3CTD%3Esrvdc4.contoso.com%3C%2FTD%3E%3CTD%3EYes%2C%20but%20additional%20resources%20required%3A%20%2B1GB%3C%2FTD%3E%3CTD%3E0%3C%2FTD%3E%3CTD%3E4.728%3C%2FTD%3E%3CTD%3E743%3C%2FTD%3E%3CTD%3E1.320%3C%2FTD%3E%3CTD%3E07%3A12%3A23%3C%2FTD%3E%3CTD%3E07%3A27%3A26%3C%2FTD%3E%3CTD%3E7.024%3C%2FTD%3E%3CTD%3E7.342%3C%2FTD%3E%3CTD%3E7.259%3C%2FTD%3E%3CTD%3E07%3A15%3A09%3C%2FTD%3E%3CTD%3E07%3A30%3A11%3C%2FTD%3E%3CTD%3E12.286%3C%2FTD%3E%3CTD%3E94%3C%2FTD%3E%3CTD%3E17%3C%2FTD%3E%3CTD%3E28%3C%2FTD%3E%3CTD%3E08%3A38%3A43%3C%2FTD%3E%3CTD%3E08%3A53%3A42%3C%2FTD%3E%3CTD%3E2%3C%2FTD%3E%3CTD%3E1%3C%2FTD%3E%3CTD%3E2%3C%2FTD%3E%3CTD%3EPhysical%3C%2FTD%3E%3CTD%3ELeipzig%3C%2FTD%3E%3CTD%3E(UTC%2B01%3A00)%20Amsterdam%2C%20Berlin%2C%20Bern%2C%20Rome%2C%20Stockholm%2C%20Vienna%3C%2FTD%3E%3CTD%3EFalse%3C%2FTD%3E%3CTD%3EMicrosoft%20Windows%20Server%202016%20Standard%3C%2FTD%3E%3CTD%3E14393%3C%2FTD%3E%3CTD%3EServer%20Core%3C%2FTD%3E%3CTD%3EServerCore%3C%2FTD%3E%3C%2FTR%3E%3C%2FTBODY%3E%3C%2FTABLE%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHow%20much%20RAM%20must%20be%20free%20and%20available%20for%20Azure%20ATP%20to%20run%20correctly%20and%20without%20warning%3F%3CBR%20%2F%3EIs%209.5GB%20RAM%20the%20maximum%20Azure%20ATP%20needs%3F%20(without%20OS%2C....)%20%3D%26gt%3B%26nbsp%3B%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-US%2Fazure-advanced-threat-protection%2Fatp-capacity-planning%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-US%2Fazure-advanced-threat-protection%2Fatp-capacity-planning%3C%2FA%3E%3CBR%20%2F%3E%3CBR%20%2F%3E%3C%2FP%3E%3CP%3EWe%20are%20currently%20testing%20Azure%20ATP%2C%20but%20we%20plan%20to%20roll%20it%20out%20soon.%3CBR%20%2F%3EFor%20better%20planing%20i%20need%20to%20know%20how%20much%20RAM%20the%20servers%20need.%3CBR%20%2F%3EIt%20is%20always%20difficult%20to%20add%20more%20RAM%20later.%3C%2FP%3E%3CP%3E%3CBR%20%2F%3Ethanks%2C%3CBR%20%2F%3EBest%20Regards%2C%3CBR%20%2F%3ERalf%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1079140%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20ATP%20sizing%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1079140%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F410791%22%20target%3D%22_blank%22%3E%40Ralfxyz%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EOn%20which%20of%20the%20above%20machines%20did%20you%20get%20the%20health%20alert%3F%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EIn%20general%2C%20it's%20important%20to%20understand%20that%20the%20sizing%20tool%20is%20based%20on%20heuristics.%3C%2FP%3E%0A%3CP%3EIt's%20pretty%20good%20most%20of%20the%20times%2C%20but%20we%20did%20see%20anomalies%20in%20networks%20that%20act%20a%20little%20different.%3C%2FP%3E%0A%3CP%3EFor%20example%2C%20different%20mixture%20of%20traffic%2C%20increased%20AD%20events%20due%20to%20lot's%20of%20Apps%20querying%20AD%2C%20or%20networks%20with%20exceptional%20amounts%20of%20AD%20entities.%20those%20and%20more%20are%20issues%20that%20the%20tool%20can't%20reasonably%20measure%2C%20so%20it%20could%20be%20that%20in%20some%20cases%20you%20would%20need%20to%20add%20more%20memory%20or%20cores%20compared%20to%20what%20the%20tool%20says%20or%20even%20mentioned%20in%20the%20table%2C%3C%2FP%3E%0A%3CP%3EStill%2C%20for%20most%20cases%20it%20is%20a%20good%20fit%20or%20a%20good%20starting%20point.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EAs%20for%20sizing...%20the%20data%20in%20the%20tables%20is%20what%20the%20sensor%20itself%20is%20consuming.%3C%2FP%3E%0A%3CP%3EIn%20addition%20to%20that%2C%20the%20sensor%20resource%20manager%20expect%20to%20have%20AT%20LEAST%2015%25%20free%20RAM%20and%20CPU%20at%20all%20times%20to%20protect%20AD%20services%2C%20or%20else%20it%20will%20throttle%20itself.%3C%2FP%3E%0A%3CP%3ESo%20for%20example%2C%20let's%20say%20the%20sensor%20needs%2010%20GB%2C%20And%20AD%20services%20%2F%20OS%20need%2010%20GB%20more%2C%20that's%2020GB%20used%20RAM%20at%20all%20times.%26nbsp%3B%20so%20in%20this%20case%2C%20I%20would%20use%20a%20machine%20with%20at%20least%2024%20GB%20of%20RAM%2C%20so%20at%20all%20times%20I%20will%20have%20a%20bit%20more%20than%2015%25%20free%2C%20and%20won't%20get%20throttled.%3C%2FP%3E%0A%3CP%3ESame%20goes%20for%20total%20CPU.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1079371%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20ATP%20sizing%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1079371%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F106935%22%20target%3D%22_blank%22%3E%40Eli%20Ofek%3C%2FA%3E%26nbsp%3BHello%20Eli%2C%3CBR%20%2F%3Ethank%20you%20very%20much%20for%20your%20fast%20reply%20and%20the%20explanation.%3CBR%20%2F%3EThe%20messages%20comes%20from%20srvdc1%2C%20srvdc2%20and%20srvdc3.%3CBR%20%2F%3E%3CBR%20%2F%3EOk%2C%20the%20warning%20comes%20because%20there%20are%20sometimes%20peak%20loads.%3CBR%20%2F%3EI%20have%20to%20check%20how%20much%20RAM%20I%20can%20provide%20for%20the%20DCs.%3CBR%20%2F%3E%3CBR%20%2F%3EThank%20you%20very%20much%20for%20your%20support.%3CBR%20%2F%3EBest%20Regards%2C%3CBR%20%2F%3ERalf%3C%2FP%3E%3C%2FLINGO-BODY%3E
Occasional Contributor

I recently set up the RAM as recommended by the sizing tool, but now I get the message again in Azure ATP "some network traffic is not being analyzed".

Currently the tool shows the following:

DCSensor SupportedFailed SamplesMax Packets/secAvg Packets/secBusy Packets/secBusy Packets/sec Start TimeBusy Packets/sec End TimeMin Avail MBAvg Avail MBBusy Avail MBBusy RAM Start TimeBusy RAM End TimeTotal MBMax % CPU TimeAvg % CPU TimeBusy % CPU TimeBusy CPU Start TimeBusy CPU End TimeLogical processorsProcessor GroupsCore CountVM IndicatorAD SiteTime Zone NameIs DSTOS CaptionOS Build NumberOS Installation TypeOS Server Levels
srvRODC1.contoso.comYes, but additional resources required: +2GB02.4385511108:17:5408:32:511.8332.0812.04007:15:5407:30:574.0958981307:20:0407:35:07212VMWareLondon(UTC+01:00) Amsterdam, Berlin, Bern, Rome, Stockholm, ViennaFalseMicrosoft Windows Server 2016 Standard14393Server CoreServerCore
srvRODC2.contoso.comYes, but additional resources required: +3GB01.940639408:21:0908:36:125341.1881.15306:23:1606:38:134.095100111407:17:5407:32:57212VMWareLyon(UTC+01:00) Amsterdam, Berlin, Bern, Rome, Stockholm, ViennaFalseMicrosoft Windows Server 2016 Standard14393Server CoreServerCore
srvRODC3.contoso.comYes, but additional resources required: +3GB02.23717322907:19:1507:34:1860092990707:26:2107:41:183.071100101407:20:0007:35:02212VMWarePune(UTC+01:00) Amsterdam, Berlin, Bern, Rome, Stockholm, ViennaFalseMicrosoft Windows Server 2016 Standard14393Server CoreServerCore
srvRODC4.contoso.comYes, but additional resources required: +3GB04.109629407:16:3407:31:3763392489906:46:4007:01:374.095100364106:23:2106:38:19212VMWareRom(UTC+01:00) Amsterdam, Berlin, Bern, Rome, Stockholm, ViennaFalseMicrosoft Windows Server 2016 Standard14393Server CoreServerCore
srvdc3.contoso.comYes, but additional resources required: +1GB013.9153.4254.29607:32:1207:47:097.3787.9877.89608:21:5408:36:5712.287100304208:11:1808:26:16414VMWareBerlin(UTC+01:00) Amsterdam, Berlin, Bern, Rome, Stockholm, ViennaFalseMicrosoft Windows Server 2016 Standard14393Server CoreServerCore
srvdc2.contoso.comYes, but additional resources required: +1GB09.6643.9344.50607:38:1807:53:157.0627.6137.55207:52:3008:07:2712.28791244708:33:1808:48:19414VMWareBerlin(UTC+01:00) Amsterdam, Berlin, Bern, Rome, Stockholm, ViennaFalseMicrosoft Windows Server 2016 Standard14393Server CoreServerCore
srvdc1.contoso.comYes, but additional resources required: +1GB012.1984.3565.56507:55:3008:10:277.3117.8437.63508:15:3808:30:3512.28776172508:01:4108:16:38414VMWareMuenchen(UTC+01:00) Amsterdam, Berlin, Bern, Rome, Stockholm, ViennaFalseMicrosoft Windows Server 2016 Standard14393Server CoreServerCore
srvdc4.contoso.comYes, but additional resources required: +1GB04.7287431.32007:12:2307:27:267.0247.3427.25907:15:0907:30:1112.28694172808:38:4308:53:42212PhysicalLeipzig(UTC+01:00) Amsterdam, Berlin, Bern, Rome, Stockholm, ViennaFalseMicrosoft Windows Server 2016 Standard14393Server CoreServerCore

 

How much RAM must be free and available for Azure ATP to run correctly and without warning?
Is 9.5GB RAM the maximum Azure ATP needs? (without OS,....) =>  https://docs.microsoft.com/en-US/azure-advanced-threat-protection/atp-capacity-planning

We are currently testing Azure ATP, but we plan to roll it out soon.
For better planing i need to know how much RAM the servers need.
It is always difficult to add more RAM later.


thanks,
Best Regards,
Ralf

 

 

2 Replies
Best Response confirmed by Ralfxyz (Occasional Contributor)
Solution

@Ralfxyz 

On which of the above machines did you get the health alert?

 

In general, it's important to understand that the sizing tool is based on heuristics.

It's pretty good most of the times, but we did see anomalies in networks that act a little different.

For example, different mixture of traffic, increased AD events due to lot's of Apps querying AD, or networks with exceptional amounts of AD entities. those and more are issues that the tool can't reasonably measure, so it could be that in some cases you would need to add more memory or cores compared to what the tool says or even mentioned in the table,

Still, for most cases it is a good fit or a good starting point.

 

As for sizing... the data in the tables is what the sensor itself is consuming.

In addition to that, the sensor resource manager expect to have AT LEAST 15% free RAM and CPU at all times to protect AD services, or else it will throttle itself.

So for example, let's say the sensor needs 10 GB, And AD services / OS need 10 GB more, that's 20GB used RAM at all times.  so in this case, I would use a machine with at least 24 GB of RAM, so at all times I will have a bit more than 15% free, and won't get throttled.

Same goes for total CPU.

@Eli Ofek Hello Eli,
thank you very much for your fast reply and the explanation.
The messages comes from srvdc1, srvdc2 and srvdc3.

Ok, the warning comes because there are sometimes peak loads.
I have to check how much RAM I can provide for the DCs.

Thank you very much for your support.
Best Regards,
Ralf