I don't think it's possible (at least not in NTA 3.5) to store uncompressed data for 7 days. The setting seems to be limited to a drop down box with 240 minutes being the maximum amount of time you can store uncompressed data. I'm guessing the limit is due to the amount of storage that would be required to store that much uncompressed data. Even on network monitoring a few netflow interfaces, you'd end up with a rather large database storing that much uncompressed data. We're monitoring almost 500 Netflow interfaces. If I tried to keep 7 days of uncompressed data I'm pretty sure our DBAs would put me on their most wanted list.
Hi ALiendan, i saw a post of you about changing the rentention of the uncompress netflow information for more than 240m ,i have the same problem. did you recived an asnwer about this? Did you solved it?
Thanks in advance.
Basically, yes, but you have to change it from the database directly rather than the Web UI and they do not recommend it. There are also finer settings to be found there like "time for 15 min. compressed data" and "time for 1hr compressed data" which could still work while reducing the burden by a great deal.
However, to track spikes, I would suggest making alerts to see when they happened and who were the top talkers at those times rather than retain uncompressed Netflow data (which is minute to minute).