The total workload for Recon depends on your data received through SmartConnectors or ArcSight Enterprise Security Manager ( ESM) and on the number of events captured by those data sources each day. For example, each day, your environment might have thousands of events. At the same time, someone might be updating details about the events or new information can be coming in about the entities associated with the events. Recon must be able to process all of these types of transactions. Thus, this document lists the requirements for small and medium workloads.
We based these recommendations on the maximum workload achievable while still maintaining stability of the system resources in our labs. It is possible that you might need to further adjust the tuning values for satisfactory peformance in your environment.