Performance and Sizing Guide

Size: px

Start display at page:

Download "Performance and Sizing Guide"

Bonnie Cain
6 years ago
Views:

1 Performance and Sizing Guide Trend Micro PortalProtect for Microsoft SharePoint 2010 Trend Micro Internal Use Only ENTERPRISE TECHNICAL SALES SERVICES

2 Trend Micro Sizing Guide PortalProtect 2.1 Table of Contents Executive Summary... 3 Assumptions and Recommendations... 4 Performance at a Glance... 4 Product Performance Comparison... 4 PP 2.1 Configuration and Performance Impact... 5 Sizing at a Glance... 6 Real-Time Scanning Example... 7 Usage Guidelines... 9 External References... 9 About Trend Micro Incorporated... 9 Copyright Trend Micro 2011 Page 2 of 9

3 PortalProtect 2.1 Trend Micro Sizing Guide Executive Summary Trend Micro has conducted tests to obtain performance characterization data for sizing Trend Micro PortalProtect for Microsoft SharePoint version 2010 (PP2.1). Trend Micro PortalProtect for Microsoft SharePoint 2010 is a server security product for Microsoft SharePoint server It provides protection in real-time from malware and malicious links. Additionally, it ensures appropriate use and protects sensitive information. Trend Micro PP2.1 introduces the smart scan method for security risk scanning. Smart scan is the next-generation, in-the-cloud protection solution. At the core of this solution is an advanced scanning architecture that uses threat signatures that are stored in-the-cloud. Trend Micro PP2.1 introduces Data Protection to protect your company-specific sensitive data from intentional or accidental loss. PP2.1 benefits from some performance tuning and performs better than PP2.0. General Performance at a Glance (compared to baseline SharePoint 2010 performance): PP2.1 Antivirus scanning with default settings reduces http throughput by 19.2% on the Web Front-end server Forefront Protection for SharePoint 2010 antivirus scanning with default settings reduces http throughput by 38.6% on the Web Front-end server PP2.1 antivirus scanning and content filtering reduce http throughput by 38.1% on the Web Front-end server Forefront Protection for SharePoint 2010 anti-virus scanning and content filtering reduces http throughput by 42.2% on the Web front-end server PP2.1 All filters with default settings reduce http throughput by 45.9% on the Web Frontend server When handling similar or higher levels of throughput, PP2.1 uses only 70.1% as much CPU resources as FFSP 2010 does with antivirus enabled. When handling similar or higher levels of throughput, PP2.1 uses only 92.8% as much CPU resources as FFSP 2010 does with antivirus and content filtering enabled. Data Protection Performance at a Glance (Compared to baseline SharePoint 2010): Data Protection introduces the following five (5) built-in policies: GLBA, HIPAA, PCI-DSS, SB-1386, US PII. GLBA demonstrated the best performance, while HIPAA showed the poorest performance. PP2.1 Antivirus and Data Protection showed an average reduction of http throughput of 39.54%. Http throughput for GLBA was reduced to by 38.2%, which was the best performance. PP2.1 Antivirus, Data Protection, and Content Filtering reduced http throughput by 42.6% on average, and reduced http throughput by 41.9% for GLBA, which was the best performance. Smart Scan Performance Impact: Smart scan throughput is similar to that of conventional scanning. However, smart scan uses 10% less memory than conventional scan. Page 3 of 9 Copyright Trend Micro 2011

4 Trend Micro Sizing Guide PortalProtect 2.1 Assumptions and Recommendations The sizing in this document is based on the following assumptions: Gigabit network interface cards (NIC) are used throughout the LAN Hardware meets the minimum suggested requirements General recommendations are as follows: Hosting Microsoft SQL Server on a different server from the one running Microsoft SharePoint Server may provide additional performance, but measuring of the affect of this change is outside the scope of this document. Processes are disk intensive. Using a progressively faster disk subsystem with Microsoft SQL Server will add performance benefits, but measuring the impact of this technology on PP 2.1 is outside the scope of this document. Performance at a Glance A baseline series of real-time scanning tests for SharePoint 2010, with PortalProtect 2.1 for SharePoint 2010, and with Microsoft Forefront for SharePoint 2010 was run and the results compiled to assess the performance impact of the latest release. The tests covered the following scenarios: Microsoft SharePoint 2010 only (baseline) Microsoft SharePoint 2010 with PP2.1 Security Risk Scan only Microsoft SharePoint 2010 with PP2.1 Security Risk Scan and Content Filtering Microsoft SharePoint 2010 with PP2.1 Security Risk Scan and Data Protection Microsoft SharePoint 2010 with PP2.1 full filtering (all filtering features enabled) Microsoft SharePoint 2010 with Forefront Protection for SharePoint (FFSP) 2010 antimalware scanning only Product Performance Comparison The baseline SharePoint 2010 was compared with PortalProtect 2.1 and Forefront 2010 in a realtime scanning scenario. The performance impact of these tests is illustrated in Table 1 and Figure 1. Table 1. Real-time Scanning Results Baseline (SharePoint 2010 Only) PortalProtect 2.1 Anti-Malware FSSP 2010 Anti-Malware Processor Utilization Throughput (Requests/s) 71.2% 73.3% Throughput Difference (%) 19.2% 38.6% Copyright Trend Micro 2011 Page 4 of 9

PortalProtect 2.1 Trend Micro Sizing Guide Figure 1. Graph of requests per second illustrating PP 2.1 improvement over Forefront 2010 Observations: Under similar CPU use circumstances, PP 2.

5 PortalProtect 2.1 Trend Micro Sizing Guide Figure 1. Graph of requests per second illustrating PP 2.1 improvement over Forefront 2010 Observations: Under similar CPU use circumstances, PP 2.1 with real-time anti-malware scanning reduced throughput performance by 19.2% compared to the baseline (SharePoint 2010 without anti-malware software installed) Although this throughput impact is measurable, PP2.1 showed much less impact when compared with other anti-malware scanning products. FFSP 2010 real-time anti-malware scanning using one engine reduced throughput 38.6% when compared to the baseline. PP 2.1 Configuration and Performance Impact Different customers choose to take advantage of different features often based on their size, industry, overall security architecture and appetite for risk. Accordingly, we compare the most common filtering configurations of PP 2.1 with the SharePoint 2010 (baseline) under similar CPU use scenarios. Table 2 shows the requests per second and the processor use during the tests, while Figure 2 graphs these results. Processor Utilization (%) Throughput (Requests/s) Baseline (SharePoint 2010 only) Table 2. Real-time scanning results on different filter settings PP2.1 Security Risk Scan PP2.1 Security Risk Scan + Content Filtering PP2.1 Security Risk Scan + Data Protection PP2.1 Security Risk Scan + Content Filtering + Data Protection PP 2.1 All filter included DLP PP 2.1 All filter excluded DLP 71.2% 73.3% 74.6% 73.6% 71.5% 70% 73.9% Throughput Difference (%) 19.3% 38.1% 38.2% 41.9% 45.9% 43.4% Page 5 of 9 Copyright Trend Micro 2011

Trend Micro Sizing Guide PortalProtect 2.1 Figure 2. Graph of messages per second for different filter settings Observations: Under similar CPU use circumstances, the throughput impact of PP2.

6 Trend Micro Sizing Guide PortalProtect 2.1 Figure 2. Graph of messages per second for different filter settings Observations: Under similar CPU use circumstances, the throughput impact of PP2.1 with anti-malware scan + Content Filtering is very similar to that of PP2.1 with anti-malware + Data Protection scan only. Under similar CPU use circumstances, there is a difference of 37.2 http requests per second between the throughput impact of PP2.1 with all filters enabled and the impact on PP2.1 with anti-malware scanning only. Sizing at a Glance This section provides a simple conversion formula, along with a sizing example, for Trend Micro PortalProtect 2.1 for Microsoft SharePoint. There are third party hardware sizing guides available for the Microsoft SharePoint server environment. These third-party sizing guides are very accurate, and therefore it is best to use this information to help the IT administrator calculate PortalProtect s impact in terms of additional message capacity the common input to such hardware sizing tools. Real-time scanning impact is relatively easy to estimate since the Trend Micro performance tests provide specific percentages about decreases for scanning throughput with PP2.1 installed. For this reason, these indicators of expected performance are used once PP is installed. The sizing formula provides new incoming throughput rates used to estimate the feature impact. Table 3 provides the conversion data. Copyright Trend Micro 2011 Page 6 of 9

7 PortalProtect 2.1 Trend Micro Sizing Guide Table 3. Sizing Formula Variable Performance Impact Value PortalProtect Security Risk scan only PortalProtect Security Risk Scan and Data Protection PortalProtect Security Risk Scan and Content Filtering PortalProtect Enabled All Filters Included DLP PortalProtect Enabled All Filters Excluded DLP Simple throughput Conversion Formula to where PP 2.1 will be installed: Performance Impact value = (T-C)/C Where: T = the throughput of SharePoint without AV Product C = the throughput of PP 2.1 in SharePoint Justified throughput = Actual throughput * (1 + Performance Impact Value) Real-Time Scanning Example An example using the HP Sizing Tool for Microsoft SharePoint 2010 is provided here, but any available tool may be used to obtain the required data. If the customer has specific requirements for their environment, they should adjust the specifications accordingly to meet their needs and tie in this measurement. Figure 3. Example using HP sizing tool for Microsoft SharePoint Assume users in system as X 2. Assume user concurrency percentage as Y 3. Assume requests per user per hour as Z 4. The requests/sec = (X * Y * Z) /3600 Page 7 of 9 Copyright Trend Micro 2011

8 Trend Micro Sizing Guide PortalProtect 2.1 Assume a customer has 10,000 users. 72% of these users access the SharePoint concurrently for a working day, with a peak number of user requests at 50 per hour. The actual throughput will be * 0.72 * 50 / 3600 = 100 requests/sec. The customer wants to enable Security Risk Scan and Content Filtering features after installing PP2.1 on their SharePoint Therefore, how many SharePoint machines are needed to handle this workload and feature set? Answer: Step 1. Convert the actual requests to the new PP2.1 value for impact calculation only. Calculation: Justified throughput = Actual throughput * (1 +Performance impact value) = 100 * ( ) = 162 Z = (Justified throughput) * 3600/X*Y = 162 * 3600 / (10000 * 0.72) = 81 Step 2. Enter the result 81 as the peak number of user requests per hour into the sizing tool. Step 3. Obtain the number of machines and hardware specifications from the tool and compare against the existing environment. Figure 4. Detailed hardware specification for example s environment using HP sizing tool Copyright Trend Micro 2011 Page 8 of 9

9 PortalProtect 2.1 Trend Micro Sizing Guide Usage Guidelines The recommendations in this document have not been validated by a third-party organization. These recommendations are intended only as sample guidelines to help administrators design for their unique requirements. This document was not created to provide recommendations for all circumstances. Specific network environments and network traffic will determine actual product performance. The tests used to create the performance data in this document were performed on a 1,000 Mbps Ethernet network with minimal latency. Therefore, the reader is encouraged to consider available network bandwidth, latency, and other factors that may affect PP2.1 performance. Furthermore, the reader should allow for performance deviations of 10 percent from these test results. The statements in this document do not represent any expressed or implied guarantee of performance of any of Trend Micro, Microsoft, HP, or Intel products. External References HP Sizing Tool for Microsoft SharePoint 2010: About Trend Micro Incorporated Trend Micro Incorporated is a pioneer in secure content and threat management. Founded in 1988, Trend Micro provides individuals and organizations of all sizes with award-winning security software, hardware, and services. With headquarters in Tokyo and operations in more than 30 countries, Trend Micro solutions are sold through corporate and value-added resellers and service providers worldwide. For additional information and evaluation copies of Trend Micro products and services, visit our Web site at Hwww.trendmicro.comH. Page 9 of 9 Copyright Trend Micro 2011

T E C H N I C A L S A L E S S O L U T I O N S

T E C H N I C A L S A L E S S O L U T I O N S Product Management Document InterScan Web Security Virtual Appliance Customer Sizing Guide September 2010 TREND MICRO INC. 10101 N. De Anza Blvd. Cupertino, CA 95014 www.trendmicro.com Toll free: +1 800.228.5651