Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
How does the quota work when analyzing many host groups collectively?
Short answer
The quota counts not the number of analyses but the analysis result rows; each analysis produces one row for every selected host group (scope and limits). 50 rows per vService and 250 rows across the device can be stored; a Collective Analysis & Learning analysis that includes three groups uses three rows of the quota. The quota is checked when a new analysis is started: first it is examined whether the device-wide total has reached 250, then whether the total of the vService has reached 50; if it has been reached, the analysis is not started, with the "Analysis limit exceeded … Please delete old analysis data" error. The number of rows the new analysis will add is not included in the check: while the vService has 49 rows, an analysis with five groups starts and the total becomes 54; at 50 rows, even an analysis with a single group does not start. There is no limit on the number of groups that can be selected in one analysis. When the quota is reached, old rows are deleted with Delete in the Analysis & Learning list; when the last row of an analysis is deleted, the analysis record is also removed. There is no fixed limit on the number of host groups that can be defined on a vService; still, defining more than 5–6 host groups is not really recommended. If many domain names need to be protected separately, the domain names are distributed to separate vServices opened on the same IP:Port with Virtual Hosting.
How Does It Work?
| Value | |
|---|---|
| Counted unit | Analysis result row (one row for every host group selected in an analysis) |
| Limit per vService | 50 rows |
| Device-wide limit | 250 rows |
| Moment of the check | When the analysis is started; over the total at that moment |
| Order of the check | First device-wide (250), then the vService (50) |
| When the limit is reached | Device-wide Analysis limit exceeded: … Please delete old analysis data; on the vService Analysis limit exceeded for '<vService>': … Please delete old analysis data |
| Number of groups that can be selected in one analysis | Unlimited |
| Number of host groups on a vService | No fixed limit; more than 5–6 is not recommended (How many host groups?) |
A collective analysis processes all the selected groups in a single operation; the learning record is read once and every row is written to the group it belongs to (What is Collective Analysis & Learning?). The quota counts only the rows that result; it does not limit the processing time or the amount of records read.
Example (the vService has 4 host groups, quota 50):
| Existing rows | Started analysis | Result |
|---|---|---|
| 40 | Collective analysis with 4 groups | Starts; total 44 |
| 48 | Collective analysis with 4 groups | Starts; total 52 |
| 52 | Analysis with 1 group | Does not start; old rows are deleted |
How Many Host Groups Should Be Defined?
Host groups are suitable for protecting a few domain names within the same vService with a separate mode and separate rules. As the number of groups increases, management also becomes heavier: the rule set of each group is learned separately, monitored separately and updated separately; each collective analysis uses as many rows of the quota as the number of groups; the protection level, Checks, the blocking page and the learning methods, on the other hand, still remain common to all the groups. For this reason, defining more than 5–6 host groups on a vService is not really recommended.
If many domain names need to be protected separately, the domain names are distributed to separate vServices. Thanks to the Virtual Hosting field in the vService form, these vServices share the same IP:Port; requests go to the right vService according to the Host header (SNI in HTTPS) and the WAF of each vService works with its own settings. Each vService uses its own analysis quota of 50 rows; the device-wide limit of 250 rows is shared.
Managing the Quota in TR7
- Opening the analysis list: In the Left Monitor Panel → WAF-Protected vServices → vService → WAF Management tab, the house icon at the top right of the Virtual Host Groups band (visible while there are several groups) opens all the analysis records of the vService, and the house icon on the mode card of a group opens the records of that group (list of the past analyses).
- Deleting rows: In the list, unnecessary rows are selected and Delete is clicked; analysis rows that have been applied and are no longer needed are deleted first (Analysis & Learning · Operational Best Practices).
- Narrowing the group selection: In the collective analysis window, the Virtual Host Groups field comes with all the groups selected each time it opens; if only the groups that need to be learned again are left, the quota is used up more slowly. The traffic of a group removed from the selection does not enter the analysis at all.
- Selecting at least one group: At least one group is left selected in the Virtual Host Groups field; an analysis started with an empty selection does not produce a result row.
- Separate limits in applying: In applying the result, there is a limit of 500 page types per group and a limit of one concurrent applying operation for the same group (applying the result).
- Running the collective analysis: Can I run an analysis for several host groups at once (Collective Analysis)?
Common Misconceptions
- "A collective analysis uses a single row of the quota." Each selected group is a separate row.
- "Close to the limit, a large analysis is rejected." The check examines only the total at that moment; if the limit has not been reached, the analysis starts and the total can exceed the limit.
- "If the vService limit has not been reached, the analysis always starts." The device-wide limit of 250 rows is checked first; the rows of other vServices are also included in this limit.
How it is done in the documentation
