Hi, On Mon, Oct 02, 2023 at 09:13:55AM +0300, Hank Nussbacher via cisco-nsp wrote: > When comparing traffic stats with SNMP, Netflow stats always appear too low > (see attachment). > > Opened a TAC case and their recommendation is to do 1:1 and I quote: > > "Irrespective of the rate at which the NP punts the records to CPU, exporter > picks up a maximum of 2000 records at a time from the cache that are > eligible for export (timers, network/TCP session events, etc). This is > basically to avoid NetIO dropping the packets due to lack of b/w. When the > exporter wakes up again, it repeats the same."
I fail to see why it would make sense to increase the number of flow
exports if their reasoning is "$machinery is busy, so, flow exports are
exported slowly"...
I do like 1:1 netflow, but the ASR9k (at least the linecards we have)
are not suitable to do that, alas - flow cache does not go high enough,
and NPU PPS is limited.
We currently do 1:10, which mostly works OK for our load, but we still
see a few
LC/0/0/CPU0:Oct 2 08:14:24.825 MEDST: nfsvr[280]:
%MGBL-NETFLOW-6-INFO_CACHE_SIZE_EXCEEDED : Cache size of 1000000 for monitor
v4mon has been exceeded
every day... (from what I understand, there should be enough LC memory
to go higher with that cache, but it cannot be configured).
gert
--
"If was one thing all people took for granted, was conviction that if you
feed honest figures into a computer, honest figures come out. Never doubted
it myself till I met a computer with a sense of humor."
Robert A. Heinlein, The Moon is a Harsh Mistress
Gert Doering - Munich, Germany [email protected]
signature.asc
Description: PGP signature
_______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
