Choosing hardware

[ottkomp]

Hello!
I'm planning hardware for Standalone mode server. This setup was suggested to me:
6511P, 16cores, 2.3GHz, 72MB cache or 4516Y+, 24cores, 2.2GHz, 45MB cache
128GB RAM
4x20TB RAID10 (keeping logs at least a year)
2x480GB RAID1 for OS
I will not use Stenographer. The WAN to firewall traffic is not big, normally.

Both Intel and AMD are supported but which one is preferred? What is most important - cores, frequency, L3 cache? 6511P or 4516Y+?
The biggest fear is that the HDD kit is slow. Is HDD suitable for Suricata and/or Zeek? Do I need SSD for it? How to make SO to use SSD for Suricata and Zeek?

[InfosecGoon]

If you're not doing full packet capture, then the spinning disks should be fine. Two questions:

1. Do you have an estimate of how much traffic you'll be observing? "Not big" means different things in different contexts -- are we talking about 10Mb/sec or 3Gb/sec?

2. Is this a hardware RAID10?

[ottkomp]

1. Usual 100Mb/s
2. Yes, hardware RAID10