Flows per Second Question

I think there are a few questions in this. When you say make things more efficient, in what regard? 

The computational load of processing flows is kind of light, in the big picture of all the things the collector servers do.  The hard part is primarily on the db side, writing new data in and then pulling it out to display later, so yes you can reduce the load on your DB by trimming the amount of flow data that gets stored.  On the other hand, unless you have a really high volume of flows coming in right now and have noticed problems with your DB performance then you probably wont notice much of an impact.

Also worth mentioning that the default settings for flows are likely to have sampling enabled on incoming flows, which reduces the load pretty substantially.  Worked with a customer a few months ago who told me they had 75,000 fps coming in and that made me nervous to hear because thats a pretty significant load to deal with, but once I saw their system I realized they were sampling that down with the auto setting and it was down sampling all the way to where only 7.5 fps worth of data was actually being written to the DB and that was a trivial load.  This anecdote is just intended to illustrate that you can process a lot of flow data with minimal impact until you start trying to write it.

- Marc Netterfield

•     Loop1: SolarWinds Training and Professional Services
•     My GitHub: Mesverrum

Thanks for the reply.

Where is the sampling enabled? Is it on the device, such as a Cisco router, or on the server side? Also, we're configuring Palo Alto firewalls to submit flows to the same server. It's my understanding that Palo Alto doesn't provide the sampling feature in their implementation. Do you know if this is correct?

Our DB Settings page indicates we're receiving about 130K FPS. Is there a way to monitor what's actually being written to the DB?

Thanks

This doc talks about the sampling settings, https://documentation.solarwinds.com/en/success_center/nta/content/nta-setting-the-sample-rate-manually-sw316.htm

I couldnt find a place in the UI where it showed exactly what numbers the auto setting actually picked for a sample rate, so i did some math in the nta database to see how many lines were being written over time.

Thanks for your input. We're in the process of gradually replacing CIsco routers with PA firewall/routers. As I've come to found out, PA does not support Sampled mode, it only runs in standard mode. As the balance between the two has shifted over time, I believe that's where were seeing an increase in the FpS. We may just have to bite the bullet and create additional collectors.