Skip to main content
Version: 5.1

Search Anywhere Framework Minimum System Requirements

General Requirements​

  • Deployment type: Dedicated physical or virtual servers
  • Component versions: All nodes must use the same version of Search Anywhere Framework components
  • Time zone and synchronization: Time synchronization must be configured (e.g., via NTP), and a single time zone must be used
  • Network infrastructure: High-speed connection between nodes – recommended at least 1 GB/s. Low network latency – no more than 10 ms
  • Storage: SSD drives are recommended for all components. XFS file system is recommended

Supported Operating Systems​

Search Anywhere Framework supports installation and operation on modern Linux distributions using the systemd initialization system. Below are the minimum and recommended hardware and software requirements, as well as the supported operating systems for all system components.

note

It is recommended to use RHEL versions 7 and 8.

ComponentDescription and supported OS
Search Anywhere Framework:
  • Search Anywhere Master Node
  • Search Anywhere Data Storage
  • Search Anywhere Web
  • Search Anywhere Data Collector
  • Search Anywhere Engine Remote Execution
  • SAF Beat Manager
  • Inventory

It is used for automated installation and configuration of Search Anywhere Framework components. Supported OS:

  • Red Hat Enterprise Linux (RHEL) 7
  • Red Hat Enterprise Linux (RHEL) 8
  • Ubuntu Server 20.04
  • Ubuntu Server 22.04
  • Ubuntu Server 24.04
  • Debian 10
  • Debian 11
  • Debian 12
  • Oracle Linux 8.7
  • Oracle Linux 8.6
ComponentSupported architectureSupported OS
Search Anywhere Framework Beatx86-64 (AMD64 / Intel 64)Windows:
  • Microsoft Windows 7 Professional / Enterprise / Home
  • Microsoft Windows 8 Professional / Enterprise / Home
  • Microsoft Windows 10 Pro / Enterprise / Home
  • Microsoft Windows 11 Pro / Enterprise / Home
  • Microsoft Windows Server 2008 R2 / 2012 R2 / 2016 / 2019 / 2022
Linux:
  • Red Hat Enterprise Linux (RHEL) 7
  • Red Hat Enterprise Linux (RHEL) 8
  • Ubuntu Server 20.04
  • Ubuntu Server 22.04
  • Ubuntu Server 24.04
  • Debian 10
  • Debian 11
  • Debian 12
  • Oracle Linux 8.7
  • Oracle Linux 8.6
s390 (IBM System z) — IBM z14Linux:
  • SUSE Linux Enterprise Server 15

ElasticBeats Version Compatibility​

Before installing or updating ElasticBeats agents, always check the compatibility matrix on the official Elastic website.

Hardware requirements​

Pay attention!

For the components to work correctly, the Java settings must be taken into account, including the JVM settings and the amount of available memory. Detailed configuration requirements are described in the section Java Settings.

ComponentMinimum requirements
Search Anywhere Framework Single Instance (all components on one node)
  • 4-core CPU (x86-64: AMD64/Intel 64)
  • 16 GB RAM
  • Fast SSD, minimum 100 GB
Search Anywhere Data Storage (short-term storage)
  • 4-core CPU (x86-64: AMD64/Intel 64)
  • 8 GB RAM
  • Fast SSD, minimum 100 GB
Search Anywhere Data Storage (long-term storage)
  • 4-core CPU (x86-64: AMD64/Intel 64)
  • 8 GB RAM
  • SSD/HDD, minimum 500 GB
Search Anywhere Master Node
  • 2-core CPU (x86-64: AMD64/Intel 64)
  • 4 GB RAM
  • Fast SSD/SSD, minimum 30 GB
Search Anywhere Data Collector
  • 4-core CPU (x86-64: AMD64/Intel 64)
  • 4 GB RAM
  • SSD/HDD, minimum 50 GB
Search Anywhere Web
  • 2-core CPU (x86-64: AMD64/Intel 64)
  • 4 GB RAM
  • HDD: 40 GB

Software Requirements​

ComponentRequirement
Operating Systems

Installation is supported on most modern Linux distributions. For details, see the Supported Operating Systems.

Dependencies

  • Required libraries and packages for ClickHouse installation:

    • libicu
    • libzstd
    • liblz4
    • libxxhash

  • Required for Search Anywhere Framework installer:

    • unzip 6.0 or higher
    • zip 3.0 or higher
    • openssl 1.0.2k or higher
    • curl 7.52 or higher

  • Additional requirements for RHEL 8:

    • libnsl2 1.2.0 or higher
    • or libnsl 2.28 or higher

  • Recommended for sme-re component:

    • memcached 1.5.22 or higher

Search Anywhere Framework Component Network Communication​

Component Search Anywhere Framework — SourcePort/ProtocolComponent Search Anywhere Framework — Destination
  • Search Anywhere Data Storage
  • Search Anywhere Master Node
  • Search Anywhere Engine Remote Execution
  • 9200/TCP
  • 9300/TCP
  • 18080/TCP
  • Search Anywhere Data Storage
  • Search Anywhere Master Node
  • Search Anywhere Engine Remote Execution
Search Anywhere Data Collector
  • 9200/TCP
Search Anywhere Data Storage
Users
  • 5601/TCP
Search Anywhere Web
Search Anywhere Web
  • 7769/TCP
Search Anywhere Framework Beat Manager
Search Anywhere Framework Beat Manager
  • 9200/TCP
Search Anywhere Data Storage
Search Anywhere Framework Beat
  • 7767/TCP
Search Anywhere Framework Beat Manager
Additional Network Communications
Search Anywhere Data Storage
  • 5432/TCP
PostgreSQL (if Inventory module is used, starting from version 5.0)
Search Anywhere Data Collector
  • 9092/TCP
Kafka (optional, configuration-dependent)
Search Anywhere Data Storage
  • 8123/TCP (without TLS)
  • 8443/TCP (with TLS)
ClickHouse (optional, configuration-dependent)
Central cluster with Cross Cluster Search mechanism, Search Anywhere Data Storage with a role remote_cluster_client
  • 9300/TCP
Subordinate cluster, Search Anywhere Data Storage
note

External Data Sources:

Additional permissions may be required for collecting analyzed data, such as:

  • Mail servers
  • Search Anywhere Framework Beat to Search Anywhere Data Collector for transmitting collected data
  • Connection to directory services Active Directory(LDAP)
  • Database connections (e.g., MySQL, Microsoft SQL Server, PostgreSQL)
  • Other external systems connected via modules and integrations

Web Browser Support​

For optimal performance of the Search Anywhere Framework web interface, we recommend using any compatible browser such as: Mozilla Firefox, Google Chrome, Safari, Microsoft Edge, other Chromium-based browsers

Minimum supported browser versions:

BrowserMinimum Version
Chrome97
Edge97
Firefox104
Opera83
Safari15.4

ClickHouse Hardware Requirements​

ParameterRecommendations
CPUClickHouse performs more efficiently with configurations featuring more cores at lower clock speeds rather than fewer cores at higher frequencies. Minimum: 4-core processor (x86-64: AMD64/Intel 64).
RAMMinimum 32GB, with 64GB+ recommended for large-scale data processing.
StorageSSD storage recommended. Minimum: 3TB (SSD/HDD acceptable).
NetworkHigh-speed inter-node connection recommended (minimum 1 GB/s) with low latency no more than 10 ms.
note

For additional details, refer to the official ClickHouse.

PostgreSQL Hardware Requirements​

ParameterRecommendations
CPUMinimum: 2-core x86-64 processor. Multi-core CPU recommended for parallel query processing.
RAMMinimum 2GB for basic operation. 4GB+ recommended for production environments and multi-user operations.
StorageMinimum 40GB. SSD recommended for improved I/O performance.
NetworkStable 1 GB/s or higher connection recommended for distributed or clustered configurations.
note

PostgreSQL version 16.7 or higher is recommended. See official PostgreSQL for details.