To reduce NTA storage size, removing Netflow Sources

Hi Guys,

I have a problem with NTA storage size. I left NTA storage retention period as default for 30-days and now total storage space (i.e. 250-GB) has been used up by NTA and there is no additional space left for newest netflow statistics to be stored on the NTA storage server.

It order to conserves some storage space for new netflow coming into NTA server, I have removed number of SVI interfaces from sending netflow traffic statistics to NTA server.

My question is, how to I get rid of the collected netflow data from those unwanted SVI interfaces for last 30days, which could possibly spare about 100-GB of space?

Any advise?

Thanks

Rizwan Rafeek

Find more posts tagged with

Accepted answers

All comments

mr.e

From the NTA Summary page, click on the Manage Sources button (provided your SW account does have rights)
Expand the Cisco tree (which shows nodes sending flows in the last 15 minutes by default)
Click on each of the nodes and then unselect any interfaces for which you do not need NTA data
Click Submit when done

By the way, you can also force DB cleanup by launching the NetflowDatabaseMaintenance.exe file. That application file is located on your core server (Program Files\SolarWinds\Orion\NetFlowTrafficAnalysis folder. Once you launch it, you should see something similar to the screenshot below. By the way, you'll notice the Wizard recommends for the SW services to be stopped if you intend to do a Full Shrink. The Full Shrink will hep you regain space on your DB, but will cause some downtime as you know. If you do cannot afford to shut down SW for a while, just select the same options as per the screenshot below. I hope this helps. Netflow DB maint wizard.GIF

choly

Unfortunately, there is currently no mechanism to delete particular unwanted data from FSDB (neither on node nor interface level). Only data removal happens when data fall behind retention period, and this is done on daily basis.

So beside of obtaining bigger drive or moving FSDB to other storage your only option is to lower retention period and wait till midnight to delete older data.

The procedure described by newkidd2 will only shrink your SQL DB, but this will probably bring almost zero effect as NTA data are being stored into FSDB now.