Large isilon deployment, CEE guidelines

I've not seen any specific recommendation as to the limits on a CEE server setup for such an environment.  There's a best practice guide on file system auditing, but it does not speak to sizing recommendations.

http://www.emc.com/collateral/white-papers/h12428-wp-best-practice-guide-isilon-file-system-auditing.pdf

The people I've spoken to here have guesses and recommendations you might expect, but no hard data or confirmed recommendations for this level of activity.  I would work closely with your account team and try to implement such auditing in a graduating stepped approach to confirm the horsepower required for your environment. 

I was thinking of the amount of auditing events being forwarded to the two servers.  You can select the access zones you are auditing and what type of events are logged.  So depending on configuration you could target a small area to begin auditing, and add in more or less as horsepower allows.  You are right that there is not a large amount of flexibility here yet, but there should be ways to keep it from being a floodgate that overwhelms those CEE servers and causes other problems. 

is there anything to tweak really ? Under auditing you can specify two CEE servers, can you specify more from the CLI ?

I just finished setting up Varonis and two brand new 10 node clusters. While i will try to separate HIPAA clients into specific areas that are being audited at some point i am afraid my CEPA servers will begin chocking. Is Isilon sending events to CEPA servers in a round-robing fashion or is one of the CEPA servers on standby ?

the cepa servers are round-robin.