Hello, I have a question about the performance of nfdump, but first, let me explain what I'm trying to do: I have a plugin that searches the collected flows for specific network prefixes (or AS-es) on each exporting router, on specific intefaces. The information is then fed into custom rrd files and plotted as png images. Searching is done by using a top 1 record/bytes and filtering by 'inif x and net 1.2.3.0/24'. Here's an example:
$nfdump -r /data/nfsen/profiles/live/$border/nfcapd.$timeslot -n 1 -s record/bytes -o "fmt:%ts %td %pr %sap -> %dap %pkt %byt %bps %in %out %sas %das %fl" '$ifType $if and net $prefix' I have to search for input traffic on a specific interface for a specific network prefix and also for output traffic for the same thing. I achieved to do this, and it works well, but execution time for 2 borders (with 3-4 interfaces each), 20 prefixes and 50 AS-es for a peak traffic of about 2Gbps takes about 3,5 minutes. In the future I will want to monitor other routers, on the same principle. As far as I see, I can do that, but either I gather less data, or I use a different machine for collecting. A colleague of mine proposed that I split my script (which is 100% sequential) into several threads that run at the same time. Each thread would call nfdump and update it's particular rrd. My question to you is this: Assuming that I start the new processes like threads (or more likely like forked processes), would I get a speed increase? I'd like to say that this script keeps the processor usage at about 60-80%. I don't know if the forked processes would load the same input file into memory again and again, or if they would share the same file (lowering memory consumption)? What are your recomandations? Thank you for your time, -- Adrian Popa ------------------------------------------------------------------------- Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier. Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642 _______________________________________________ Nfsen-discuss mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
