On 23/3/11 12:54 PM, Phil Mayers wrote:
> On 23/03/11 08:56, Peter Haag wrote:
>
>> to disk. On a busy system, you should run multiple collectors in order to
>> prevent a socket bottleneck.
>
> What do you mean by this?
You can have multiple exporters/routers sending the netflow data to a single
nfcapd process which takes care of all the
flows. The bottleneck there is the single receive socket, where you pipe
everything through. This is ok as long as your
box is powerful enough in order to cope with that. For really busy feeds, it
makes sense to have a single collector per
exporting router. This give you more parallel receive sockets, and therefore
more throughput towards the I/O system,
which in turn need to cope with the data.
- Peter
>
>> We collect around 120GB netflow data a day ( compressed ) and have maybe
>> 10 sequence errors a day. Unfortunately I do not see the RcvbufErrors on
>> our Debian .. but due to the little sequence errors, I believe there are
>> not so many.
>> Most of the time I/O is the biggest concern. If you have the same behaviour
>> on a memory file system, it must be something else ..
>>
>> I'd be interested in the experience of other users.
>
> We see a couple of hundred a minute on a netflow from a really busy
> router. Netflow is about 25Mbyte/minute.
>
> Interestingly, we only see it on that router; no problem on other
> (busier) routers.
>
> ------------------------------------------------------------------------------
> Enable your software for Intel(R) Active Management Technology to meet the
> growing manageability and security demands of your customers. Businesses
> are taking advantage of Intel(R) vPro (TM) technology - will your software
> be a part of the solution? Download the Intel(R) Manageability Checker
> today! http://p.sf.net/sfu/intel-dev2devmar
> _______________________________________________
> Nfdump-discuss mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/nfdump-discuss
--
Be nice to your netflow data. Use NfSen and nfdump :)
------------------------------------------------------------------------------
Enable your software for Intel(R) Active Management Technology to meet the
growing manageability and security demands of your customers. Businesses
are taking advantage of Intel(R) vPro (TM) technology - will your software
be a part of the solution? Download the Intel(R) Manageability Checker
today! http://p.sf.net/sfu/intel-dev2devmar
_______________________________________________
Nfdump-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfdump-discuss
