On May 13, "Michael Bellears" wrote: > We have happily been using flow-tools for the last couple of years(For > billing) with just the one exporter (Cisco 7206VXR) - We will be > increasing this to 4 7206's over the next few months. > > Just wondering what the is the best method to handle the seperate > exporters? (Separate flow-tools server for each, then "combine" the > flows, or have them all exporting to the one flow-tools server?). > > The routers will be in geographically disperse locations.
Since flow PDUs are UDP, we tend to try to put flow-collectors geographically near the routers, then ship the collected files to a processing box via a reliable transport (i.e. tcp.) At the collector box, there's a /data/router_ directory for each router, and our analysis scripts do things like flow-cat /data/router*/*$date* to scoop up all the flow data; it's easier to recombine than to sift out. The flow-collectors themselves can be very modest servers; flow-capture doesn't take a lot of CPU, at least with the routers we have. Mike _______________________________________________ Flow-tools mailing list [EMAIL PROTECTED] http://mailman.splintered.net/mailman/listinfo/flow-tools
