# wazuh-performance-tuning

Companion files for the lesson **Wazuh Performance Tuning: EPS, Heap, Shards and Queues**:
<https://maheshtata.com/wazuh/wazuh-performance-tuning/>

Tested against: Wazuh 5.0 (beta5 documentation, Sep 2026), Ubuntu 24.04.
Not yet validated in a lab; treat every value as a starting point.

## Files

| File | What it is |
| --- | --- |
| `eps-by-minute.json` | Aggregation body for `GET /wazuh-events-v5-*/_search`: documents per minute, top 20 agents, top 20 integrations. |
| `measure-eps.sh` | Read-only snapshot: cluster health, memory locking, index sizes, ingest rate, stored Setup settings. |

## Usage

Paste `eps-by-minute.json` (minus its `_comment` key) into
**Indexer management > Dev Tools** after `GET /wazuh-events-v5-*/_search`, or
run the script:

```bash
INDEXER_URL=https://127.0.0.1:9200 \
INDEXER_USER=admin \
INDEXER_PASS='...' \
WINDOW=now-24h \
  ./measure-eps.sh
```

Divide each `per_minute` bucket count by 60 to get EPS.

## Two things the query deliberately does not do

- **It does not query `wazuh-findings-v5-*`.** A finding exists only when a
  rule matched, so counting findings measures detection output, not ingest
  rate. For finding volume by rule, use the aggregation in the
  [false positives lesson](https://maheshtata.com/wazuh/wazuh-false-positives/).
- **It does not write anything.** Changing `engine.index_raw_events` is a
  separate, deliberate `PUT /_plugins/_setup/settings` call, not something a
  measurement script should do for you.

## Reference values from the 5.0-beta documentation

Kept here so you can compare a measurement against them without opening the
lesson.

| Thing | Documented value |
| --- | --- |
| Indexer heap | Half of system RAM, `-Xms` and `-Xmx` equal |
| Data stream rollover | 20 GB primary shard size or 200 million documents |
| Retention, `wazuh-events-raw-v5` | 10 minutes |
| Retention, `wazuh-events-v5-*` | 1 hour |
| Retention, `wazuh-findings-v5-*` | 90 days |
| Retention, `wazuh-active-responses` | 3 days |
| Storage per server, 90 days | 3.7 GB at 0.25 EPS |
| Storage per workstation, 90 days | 1.5 GB at 0.1 EPS |
| Storage per network device, 90 days | 7.4 GB at 0.5 EPS |
| Manager hardware | 8 GB / 4 cores minimum, 16 GB / 8 cores recommended |
| Indexer hardware per node | 8 GB / 4 cores minimum, 32 GB / 8 cores recommended |
| Manager disk | At least 20 GB; the Vulnerability Scanner feed needs 15 GB of it |