For the Data Connector service on a BloxOne host, use the 750 GB VM version as the data connector requires more disk space if a destination is unavailable or if the on-prem host running Data Connector service is overloaded.
It is 750Gb because we cannot predict Events-Per-Second or how fast a log destination will be able to accept messages/possible communication issues. By way of annecdote. a small lab with less than 10 VM's for 3 weeks had its data connector VM using only 38GB total.
The cloud data connector will start cleaning up the files automatically when the disk usage crosses the threshold percentage configured for the disk by navigating to Notifications → Notification Settings → Default Application Thresholds → Host Disk Usage.
The cloud data connector can process 12K queries per second in secure mode and 24K queries per second in insecure mode when the source is Bloxone Cloud and the destination is a Splunk Server.
QPS is highly dependent on the delivery protocol and the destination. E.g. encryption slowdowns everything, if a destination can't handle the load (accept and process packets) - it will slowdown CDC. It can probably do about 20k EPS but it can go higher.
If the source is NIOS, the data that CDC gets in in GZ format but if the source is BloxOne Cloud, the data that CDC gets is in parquet format.
Depending on the destination the format will be different. If the destination is Splunk the format would be CSV. So, CDC does not send the log file compressed.
Destination cannot be assigned to more than one service instance.
5th May 2023 - Infoblox disabled the option to send Query/Response Logs via CDC when NIOS is the source and BloxOne Cloud is the destination.