-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 3/15/10 10:39, Alistair Cockeram wrote:
> I am trying to get a better idea on the performance constraints on NFSEN
> prior to purchasing new server hardware.
>
> When running long queries through NFSEN such as over three months of live
> data, is CPU, memory or Disk the most likely place for system performance
> to be affected?
In almost all situations it's the I/O performance of your disk(array). The
CPU is most often less an issue. It also depends on what you what to process.
For Top N record statistics, you need lot's of memory too, as all flows are
loaded into RAM, to place simple queries, it's almost equivalent to a file
copy ( I/O bound ).
>
> When running a query through NFSEN, do the called processes take
> advantage of multiple CPU cores or is this reliant on a single thread? I
> assume from the configuration file that building a new profile can utilise
> multiple cores.
Building profiles make use of multiple cores, if you use NfSen 1.3.2, the
queries are single threaded.
>
> Any recommendations on hardware specifications for 2TB of netflow data
> covering a period up to 180 days?
It's hard to give any recommendation as 180 days in my network is different
than 180 days in your network. It's the number of data you ship to and from
the disk, the number of flows/s the umber of profiles you want to have and
so on. Good disk I/O and lot's of RAM make more fun. CPU is less critical,
although x64 CPUs scale better than x32's. Future versions of NfSen/nfdump
will also make better use of multi-core technology.
- Peter
>
> Any further information regarding performance would be greatly
> appreciated.
>
- --
_______ SWITCH - The Swiss Education and Research Network ______
Peter Haag, Security Engineer, Member of SWITCH CERT
PGP fingerprint: D9 31 D5 83 03 95 68 BA FB 84 CA 94 AB FC 5D D7
SWITCH, Werdstrasse 2, P.O. Box, CH-8021 Zurich, Switzerland
E-mail: [email protected] Web: http://www.switch.ch/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (Darwin)
iQCVAwUBS54erP5AbZRALNr/AQIsPgQAnPHv7CM07ZtCyn/d3xzhgLj1mo+Lky5y
mkwPAtsk6S09Fp7fLv071RAgkebmvz5TbjTUKv3pBdvITXEGm2GGq3DlivRwgpOm
XUyBLB1OtaSw2yeFoksNqXfqIIMXwAPQEWTKDZN1+d5xsT4hCyw5OowCSUUUdGZa
aNzTH0hTJBA=
=bJAK
-----END PGP SIGNATURE-----
------------------------------------------------------------------------------
Download Intel® Parallel Studio Eval
Try the new software tools for yourself. Speed compiling, find bugs
proactively, and fine-tune applications for parallel performance.
See why Intel Parallel Studio got high marks during beta.
http://p.sf.net/sfu/intel-sw-dev
_______________________________________________
Nfsen-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
