Install WatchGuard Dimension

WatchGuard Dimension is distributed as a VHD file for installation on Hyper-V for Microsoft Windows Server 2019 or 2022, and Hyper-V Server 2019.

WatchGuard Dimension is distributed as an OVA file for installation on VMware ESXi 6.5, 6.7, 7.0, or 8.0.

For installation instructions, go to:

VMware — Install Dimension on VMware
Hyper-V — Install Dimension on Hyper-V

Complete installation instructions are also available in the WatchGuard Dimension Release Notes on the WatchGuard website.

After you install and start the WatchGuard Dimension VM, run the WatchGuard Dimension Setup Wizard and configure the initial settings for Dimension.

Before You Install Dimension

Determine System Memory Allocation

Before you begin the installation process for Dimension, make sure you consider how much memory to allocate for Dimension. To determine the necessary amount of memory, you must consider the number of Fireboxes that will send log messages to Dimension, the number of Fireboxes that will be managed by Dimension, and whether you will use the built-in PostgreSQL database or an external PostgreSQL database.

The Dimension Log Collector and Web Service maintain persistent connections to the PostgreSQL database and copies the log messages to the database. Because the Dimension system memory is shared between the Log Collector, the Web Service, the PostgreSQL database, and the other Dimension services, the number of devices that can send log messages to Dimension, and be managed by Dimension, depend on the amount of memory you specify when you install Dimension, and on whether you use the built-in PostgreSQL database or an external PostgreSQL database.

If you use the built-in PostgreSQL database, ¼ of the Dimension system memory is available for the Log Collector and the Web Service. The remainder of the memory is used by the PostgreSQL database and the other Dimension services. If you use the external PostgreSQL database, ½ of the Dimension system memory is available for the Log Collector and the Web Service, because the PostgreSQL database runs on another server. The remainder of the memory is used by the other Dimension services.

To determine how much memory to specify for your instance of Dimension, you need the approximate number of devices that will send log messages to your instance of Dimension and that you will manage with Dimension. For example, if your instance of Dimension has 2 GB of system memory and uses the built-in PostgreSQL database, your instance of Dimension can manage up to 250 Fireboxes and accept logging connections from up to 250 Fireboxes.

Number of Devices	System Memory (Built-in Database)	System Memory (External Database)
100	1200 MB	600 MB
200	2400 MB	1200 MB
400	4800 MB	2400 MB
500	6000 MB	3000 MB

Determine Disk Size for Dimension Storage

To determine the amount of disk space to allocate for the Dimension log database, you must consider these factors:

The number of devices that send log messages to Dimension
The number of users that generate traffic behind each device
The number of connections or sessions initiated by each user
The amount of time each user spends on the Internet and on other services on your network
The Subscription Services that are enabled on each device
The number of log events that each device sends to Dimension
The log level configured for each type of log message sent to Dimension
The amount of disk space Dimension uses for the database (80%)

Because these factors can vary greatly, it is not possible to provide the exact disk size necessary for log storage in each Dimension installation. However, based on real-world data observed by WatchGuard in several different customer installations, across a broad range of industries and usage scenarios, we recommend that you use the figures from the next example as a conservative guideline to select the disk size for your instance of Dimension.

For an average log message size of approximately 800 bytes, one million log events use approximately 0.75 GB of disk space. Because Fireware is consistent across Firebox models, the amount of log data varies based on the number of users, not the Firebox itself. For example, a Firebox with 800 users generates 10 times the amount of log data as a Firebox device with 80 users. This table shows some typical sizing scenarios by user.

Log Messages Per Minute by User	Low	Average	High
Firebox only	1	3	6
Firebox with UTM	2	5	10

To determine the approximate disk space necessary, follow these calculations:

Average log messages per minute X 60 minutes per hour X 24 hours per day = Number of log message per user, per day

Number of log messages per day X number of users = Number of log messages for the device each day = Disk space in GB used each day (1 million events = 0.75 GB)

Disk space in GB used each day X number of days = GB of database storage is required for this device

When the database is local to the Dimension system, the maximum size of the database is limited to 80% of the size of the data disk for the virtual machine. The oldest data is automatically purged when database utilization reaches approximately 95% of the maximum database size.

For example, if you have a M470 device that runs Fireware OS with Subscription Services enabled, has approximately 100 users, and is in the average range, the calculations to determine the approximate disk space necessary to store the log messages from the M470 device for each day are:

5 log messages per minute X 60 minutes X 24 hours = 7200 log messages per user, per day

7200 X 100 users = 720,000 log messages for the device each day = 0.5 GB of disk space necessary for this device each day

To keep 30 days of data for this device, then 0.5 GB per day X 30 days = 15 GB of database storage is required for this device.

If this was the only device sending log messages to the Dimension system, the data disk for the virtual machine should then be configured to be 15 GB / .8 = 18.75 GB

If you do not enable debug logging on your Firebox, approximately 90% of the log messages will be traffic log messages. If you enable debug logging to investigate an issue on a Firebox, the diagnostic log message could potentially generate over 90% of the log messages for the Firebox, and reduce the amount of disk space available to store traffic log messages.

If you already have an instance of Dimension, you can review the statistics in the Database Status Report to monitor the daily log message statistics from your network and determine the necessary size of your Dimension database based on the amount of log messages generated by your devices.

For more information about the Database Status Report, go to Configure and Monitor the Dimension Database.

Here is an example of the Statistics section in the Database Status Report:

Statistics for appliance Firebox_Example:

--------------------------------------------------------------

Log Counts:

Traffic:      369

Event:        186

Alarm:        0

Performance:  750

Status/Debug: 3

Average Log Rates:

Traffic: 0.02/s

Status/Debug: 0.00/s

Alarm: 0.00/min

Event: 0.49/min

Performance: 1.98/min

Total: 0.06/s

Reporting statistics:

Report records: 380

Report logs: 1525

Number of client users in reports: 0

Number of client hosts in reports, (excluding "Denied Packet" reports): 37

Average report logs/client host: 16

Average report records/client host: 2

Upgrade from Dimension v1.0

When you upgrade from Dimension v1.0 to v1.2, there is a special, two-step process you must follow. For instructions to complete this process, go to Upgrade Dimension from v1.0.

You can also find these upgrade instructions in the WatchGuard Dimension Release Notes on the WatchGuard website Release Notes page.

Upgrade to Dimension v2.2