If you’re trying to meet specific reporting requirements while at the same time hoping to optimize database storage requirements, the question of how Orion NTA data compression works will inevitably come up. With some help from the dev folks, I feel like I understand it enough to try to explain it to everyone else ;-)
Orion NTA performs compression on flow data by combining older flows by conversation and summing up the total traffic numbers. So, it’s still the same old flow data you knew and loved, but just summarized to save database space and improve resource and report loading times on historical data.
By default NTA retains:
- 1-minute granularity for the last 60 minutes of data. After 60 minutes, it gets collapsed into 15-minute segments (“keep uncompressed data” setting in NTA global settings).
- 15-minute granularity for 24 hours. After 24 hours, it gets collapsed into hourly data (CollapseTrigger2InHours option in NetFlowGlobalSettings table = 24)
- Hourly granularity for 3 days. After 3 days, it gets collapsed into daily data (CollapseTrigger3InDays option in NetFlowGlobalSettings table = 3)
- Daily data for 30 days. After 30 days, the data expires and it is deleted (RetainCompressedDataInDays option in NetFlowGlobalSettings table = 30)
It’s important to map your reporting granularity requirements to the appropriate NTA compression settings. For example, if you need 1-min granularity on the last 3 hours worth of data, you’ll want to set “keep uncompressed data” in NTA global settings to 180 minutes.
WARNING: Before changing any of the default compression settings, make sure the changes are absolutely necessary. Adjusting compression settings to retain granularity for longer periods will increase the amount of DB storage required and may impact reporting and website loading performance.