Increase Max Range Size

[rgu]

Has anyone tested using values larger than 100,000 (the default with Geneva) for glide.discovery.max_range_size (the maximum number of IP addresses per discovery schedule)? If so, what were the results/ramifications? Were performance issues experienced on the instance or MID servers?

We have around 2.8 million IP address to scan, and would prefer to use the least number of discovery schedules possible. The 100,000 value is limiting. We would like to increase the number, but first wanted to see if anyone in the community has experience doing so.

Thanks for your time.

[Chuck Tomasi]

Hi,

The ramification of using larger numbers is that it takes longer for the Shazzam phase to run it's initial scan. Ultimately, it will take longer for the schedule to complete because you are using larger ranges. This could impact other schedules (or successive ones.) If you are scanning every 6 hours and the range is so large that it takes 8 hours to complete, that's no good.

Have you looked at additional MID servers to help manage the load?

[glennpinto]

Chuck is correct that increasing schedules beyond 100,000 will make them take longer to complete which if you have other schedules that are dependent on this schedule completing, will lengthen the time for those other schedules to start. There are options however to speed up schedules now where in the past Shazzam used to be the bottleneck so if you had a schedule with 100,000 targets, Shazzam would have to scan each of those before the Shazzam input payload was returned and classification could start.

Now they have on the schedule batch size and shazzam clustering which if used can speed your schedule from completing.

Batch size if used with one mid server (no mid server clustering), will batch the scanning and returning of shazzam input records so that classification can start earlier on that group of records. So 100,000 targets with a batch size of 10,000, will return results in 10 batches. If you have your mids in a load balance cluster and have cluster support checked in the schedule, then you will further improve performance.

Shazzam Cluster Support (Improves performance if more than one MID Server is available): Select the check box to distribute Shazzam processing among multiple MID Servers in a Load Balance cluster to improve performance. For example, if 10000 IP addresses were defined as targets in a Discovery schedule and it was configured to use a MID Server that was part of a 5 MID Server Load Balance cluster, then each MID Server would would be assigned its own Shazzam probe with 2000 IP targets, breaking up the initial Shazzam probe. Without Shazzam cluster support enabled, only one MID Server would be assigned all the work to scan 10000 IP addresses during the initial Shazzam port scan.

Note that batch size will work with cluster support so if the batch size were set at 500, each shazzam probe of 2000 will return results in batches of 500.