The metrics and suggestions in this section are based on tests performed by Quest quality control.
InTrust agents send events to InTrust servers in batches. By default, the event submission rates
are as follows:
- On Windows servers, including domain controllers, a batch file is sent every minute.
- On workstations, a batch file is sent every seven minutes.
A repository can accept a maximum of 15 batch files per second. This means that a repository can
handle gathering from no more than about 900 Windows servers or about 6300 workstations simultaneously.
If you have both servers and workstations in the collections that use the same repository, you can
check if the number of computers that the repository is handling is within the repository's limits.
For that, you should know how many workstations and how many servers send events to that repository.
If the following comes out negative, there are too many computers:
6300 — (number of workstations) — 7 * (number of servers)
Another consideration is that a single InTrust server can gather from no more than 1800 computers
(servers or workstations) at a time.
Therefore, to avoid exceeding this threshold:
- Keep track of how many computers there are per InTrust server.
- Add InTrust servers if necessary.
- Assign different servers to different collections.
- Distribute the computers among your collections evenly.
