Performance planning

This section details the run-time characteristics of a typical Prisma Cloud deployment. The information provided is for planning and estimation purposes.
System performance depends on many factors outside of our control. For example, heavily loaded hosts have fewer available resources than hosts with balanced workloads.

Scale

Prisma Cloud has been tested and optimized to support up to 10,000 Defenders per Console. Higher numbers of Defenders per Console can be supported, as long as the required resources are allocated to Console.

Scanning performance

This section describes the resources consumed by Prisma Cloud Defender during a scan. Measurements were taken on a test system with 1GB RAM, 8GB storage, and 1 CPU core.

Host scans

Host scans consume the following resources:
Resource
Measured consumption
Memory
10-15%
CPU
1%
Time to complete a host scan
1 second

Container scans

Container scans consume the following resources:
Resource
Measured consumption
Memory
10-15%
CPU
1%
Time to complete a container scan
1-5 seconds per container

Image scans

When an image is first scanned, Prisma Cloud caches its contents so that subsequent scans run more quickly. The first image scan, when there is no cache, consumes the following resources:
Resource
Measured consumption
Memory
10-15%
CPU
2%
Time to complete an image scan.
1-10 seconds per image. (Images are estimated to be 400-800 MB in size.)
Scans of cached images consume the following resources:
Resource
Measured consumption
Memory
10-15%
CPU
2%
Time to complete an image scan
1-5 seconds per image. (Images are estimated to be 400-800 MB in size.)

Real-world system performance

Each release, Prisma Cloud tests performance in a scaled out environment that replicates a real-world workload and configuration. The test environment is built on Kubernetes clusters, and has the following properties:
  • Hosts:
    20,000
  • Hardware:
    • Console:
      16 vCPUs, 50 GB memory
    • Defenders:
      2 vCPUs, 8 GB memory
  • Operating system:
    Container-Optimized OS
  • Images:
    323
  • Containers:
    192,087 (density of 9.6 containers per host)
The results are collected over the course of 24 hours. The default vulnerability policy (alert on everything) and compliance policy (alert on critical and high issues) are left in place. CNNF is enabled.
Resource consumption:
The following table shows normal resource consumption.
Component
Memory (RAM)
CPU (single core)
Console
1,474 MiB
8.0%
Defender
82 MiB
1.0%

WAAS performance benchmark

Minimum requirements

Results detailed in this document assume a Defender instance complying with these minimum requirements.

Methodology

Benchmark target servers

Benchmark target servers were run on AWS EC2 instances running Ubuntu Server 18.04 LTS
Instance type
Environment
Compared servers
Versions
t2.large
Docker
Nginx vs WAAS-protected Nginx
Nginx/1.19.0
t2.large
Host
Nginx vs WAAS-protected Nginx
Nginx/1.14.0
t2.large
Kubernetes
Nginx vs WAAS-protected Nginx
Nginx/1.17.10