Bandwidth requirements for Netwrix Auditor depend on whether or not network traffic compression option is enabled to collect data from domain controllers:
- Without the compression service:
Bandwidth is calculated as a sum of the security logs for each monitored domain controller. For example, if 7 domain controllers generate 50 MB of events per day, 350 MB will be transferred daily.
- With the compression service:
Network traffic compression service is used to optimize traffic usage. The service is a lightweight executable that runs on domain controllers, collects data, pre-filters it and sends to Netwrix Auditor in a highly compressed format. Compression service requires approximately 1 Kb per AD change. Essentially, the bandwidth requirements depend on the amount of changes to the AD environment. For example, if 100 changes are done daily, 100 Kb of data will be transferred across all domain controllers.
To enable the traffic compression option, navigate to Netwrix Auditor -> your Monitoring Plan; select Active Directory data source; double-click it or click Edit data source and check “Enable network traffic compression” option.