The amount of space required for your database is governed by many factors that are mostly unique to the deployment scenario. These factors determine the amount of data you want to retain in the database and the time for which the data has to be retained.
Things to consider while determining your database size requirements are:
Aggregate alert and packet log volume from all Sensors — Many Sensors amount to higher alert volume and require additional storage capacity. Note that an alert is roughly 2048 bytes on average, while a packet log is approximately 1300 bytes.
Lifetime of alert and packet log data — You need to consider the time before you archive or delete an alert. Maintaining your data for a long period of time (for example, one year) will require additional storage capacity to accommodate both old and new data.
As a best practice, Trellix recommends archiving and deleting old alert data regularly and trying to keep your active database size to about 60% of the disk space.
Note
For more information, see Capacity Planning in Trellix Intrusion Prevention System Product Guide.