System requirements
Supported operating systems, runtime, memory, CPU, storage, network, browsers and ports for an XPLG server or cluster, with the sizing profiles to start from.
What you will do: check the host, the operating system, the resources and the network before you install, so the first start is not a troubleshooting session.
XPLG runs from a single standalone server to a distributed high-availability cluster. The right size depends on three numbers: the daily ingestion volume, the retention you need (hot and cold) and the concurrency (active users, dashboards, queries). There are no predefined ingestion or retention limits; the profiles below are the starting points field deployments use. For the full method see Sizing and capacity planning.
Operating systems
| Platform | X8 (8.2.0-Main, Compose) | V7 (7.9859, installer) |
|---|---|---|
| Linux x86_64 — RHEL 9+, Ubuntu 20.04 / 22.04 / 24.04 LTS, kernel 3.x+ (recommended) | Host for Docker or Podman Compose | Supported |
| Windows Server 2016 and newer | — | Supported; required for direct Windows Events and UNC collection — see Windows Server |
| macOS 12 (Monterey) and newer | — | Evaluation and non-production only |
| Kubernetes, OpenShift, Tanzu, Swarm, ECS / ACI / Cloud Run | Planned | Not a product target |
Runtime and dependencies
- Java: Java 17 is bundled with the V7 installer; the NoJava variant needs your own Java 17 (
LAX_VM). Builds below 7.9001 cannot take current patches — see Release notes. - Python (Linux, V7): 3.12 or newer.
- Containers (X8): Docker Engine 29 or newer per the current requirements page; the Compose guide was validated from Docker 20.10 with Compose 2.20, or Podman 4.7, and needs cgroups v2 — see Docker.
- Browsers: current Chrome (recommended), Firefox or Edge. Internet Explorer is not supported.
Memory and JVM
Memory is the critical resource: indexing, searches and aggregations run in memory.
- Production: 32–128 GB RAM per host. Minimum 16 GB, which is not a production size.
- Allocate about 60 % of system memory to XPLG on Linux and about 70 % on Windows.
- Keep the Java heap of one process at or below 32 GB; a larger heap degrades garbage collection instead of helping.
- Lower Linux swappiness so the host does not page the heap.
The heap is set in the lax file (-Xmx); see Configure after installation.
CPU
XPLG gains more from core count than from clock speed.
- Standalone: 8–16 cores.
- Production and cluster nodes: 16–32 or more cores.
Storage
Indexing and queries are I/O intensive.
- Use NVMe (preferred) or high-performance SSD. Avoid spinning disks and RAID 5 (write penalty); RAID 0, 10 or 01 are the preferred layouts.
- NAS is supported for the shared configuration and the cold tier but adds latency; X8 node state under
/node/datamust stay on local disk. - Size the data disk from daily volume × retention; the cold archive compresses to about 10 % of the hot size.
- Linux file descriptors: at least 64,000 open files and 20,000 processes for the user that runs XPLG.
Network
- 1 GbE minimum; 10 GbE preferred for clusters.
- Keep every node of a cluster in one data centre or region — latency between nodes hurts more than any other factor — and NTP-synced.
Inbound ports (to XPLG)
| Port | Protocol | Purpose |
|---|---|---|
| 22 | SSH | Host management on Linux (not used by the product) |
| 30303 | HTTP | Web console and inter-node traffic (configurable; set to 0 to disable plain HTTP) |
| 30443 | HTTPS | Secure console and inter-node traffic (configurable) |
| 514 | UDP / TCP | Syslog listener (TCP listeners commonly use 1468) |
| 2055 | UDP | NetFlow v5 / v9 listener, when enabled |
X8 adds the role ports ui 30304, listener 30305, processor 30306, master 30308, and Traefik on 80 / 443 / 30303 / 30443 plus 8304–8308 — see Docker.
Outbound ports (from XPLG)
| Port | Protocol | Purpose |
|---|---|---|
| 25 | SMTP | Email alerts and reports |
| 162 | SNMP | Traps |
| 389 / 636 | LDAP / LDAPS | Directory authentication |
| 1521, 1433, 3306, 50000, 5432 | TCP | JDBC pull sources: Oracle, SQL Server, MySQL, DB2, PostgreSQL |
| 135–139, 445 | TCP | Windows shares and UNC paths, only for agentless collection from Windows hosts |
| 443 | HTTPS | dock heartbeat, cloud and SaaS source plugins, Teams / Slack / PagerDuty alerts (through a proxy if required) |
Every port is configurable; the table lists the defaults.
Deployment profiles
| Profile | Daily volume | Hosts and size |
|---|---|---|
| Small / evaluation | under 5–10 GB/day | one host, 16 cores, 32 GB RAM |
| Standard production | under 10 GB/day | one host, 16 cores, 64 GB RAM |
| Cluster, processing nodes | under 25 GB/day | 1 node × 16 cores, 64 GB |
| under 100 GB/day | 2 nodes × 24 cores, 64 GB | |
| under 500 GB/day | 3 nodes × 32 cores, 128 GB | |
| Cluster, UI nodes | under 25 / 100 / 500 GB/day | 16c 64 GB / 32c 64 GB / 32c 128 GB; add UI nodes behind a load balancer for concurrency and availability |
| Above 500 GB/day | — | contact support@xplg.com for capacity planning |
Below about 10 GB/day a single process may do; above it, run processor and UI roles on dedicated instances. A dedicated listener node in Agent Mode runs with 2 GB.
Checklist before you install
- OS and architecture from the table above; on Linux the open-files and process limits are raised.
- RAM, CPU and NVMe sized from the profile; the data path is local and fast.
- Inbound 30303 / 30443 open from the users' network, the listener ports open from the sources, outbound 443 open to dock.xplg.com for the heartbeat.
- NTP on every host; one region per cluster.
- The installer or image, and the license path: evaluation licenses come from your dock workspace — see Get an evaluation license.
Next: Docker
Source: XPLG wiki, pages 1594132078, 1598685161, 1594132392, 1594132180, 3150544899, 3150774276, 1707180033 (https://xpolog.atlassian.net/wiki/spaces/XPOL/pages/1594132078).
