cancel
Showing results for 
Search instead for 
Did you mean: 

How Orion NTA Data Compression Works

Level 18

If you’re trying to meet specific reporting requirements while at the same time hoping to optimize database storage requirements, the question of how Orion NTA data compression works will inevitably come up. With some help from the dev folks, I feel like I understand it enough to try to explain it to everyone else ;-)

Orion NTA performs compression on flow data by combining older flows by conversation and summing up the total traffic numbers. So, it’s still the same old flow data you knew and loved, but just summarized to save database space and improve resource and report loading times on historical data.

By default NTA retains:

  • 1-minute granularity for the last 60 minutes of data. After 60 minutes, it gets collapsed into 15-minute segments (“keep uncompressed data” setting in NTA global settings).
  • 15-minute granularity for 24 hours. After 24 hours, it gets collapsed into hourly data (CollapseTrigger2InHours option in NetFlowGlobalSettings table = 24)
  • Hourly granularity for 3 days. After 3 days, it gets collapsed into daily data (CollapseTrigger3InDays option in NetFlowGlobalSettings table = 3)
  • Daily data for 30 days. After 30 days, the data expires and it is deleted (RetainCompressedDataInDays option in NetFlowGlobalSettings table = 30)

It’s important to map your reporting granularity requirements to the appropriate NTA compression settings. For example, if you need 1-min granularity on the last 3 hours worth of data, you’ll want to set “keep uncompressed data” in NTA global settings to 180 minutes.

WARNING: Before changing any of the default compression settings, make sure the changes are absolutely necessary. Adjusting compression settings to retain granularity for longer periods will increase the amount of DB storage required and may impact reporting and website loading performance.

About the Author
Standing side by side with teammates, jumping up and down, waiting to exit the tunnel as tens of thousands of fans rise to their feet and erupt with the thunderous roar of clapping in unison...this was one of my fondest memories from my time at the University of Texas. Unfortunately, I was just one of the clapping fans. At five foot eight and a buck fifty, it's probably better that way. I will spare you the long job history... Before I went to the dark side (of product marketing):  IBM RS6000 division  IBM Global Services Transitioning (the force was strong):  Tivoli Systems (assimilation into IBM) May as well have been Darth Vader: PentaSafe (startup acquired) -> NetIQ Identity Mgmt Division in Sun Microsystems SolarWinds - 2nd PM UnboundID SolarWinds (Yes, I couldn't stay away, so I'm back!) So, I've now been at SolarWinds for a long time (especially if you don't count my brief sabbatical) - long enough to have been involved in PM'ing virtually every Orion platform-based product in the portfolio. More than you ever wanted to know about me... I could eat sushi every day. I prefer Cabernets and Merlots over Pinots, despite the guidance from Sideways fanatics. I've intentionally avoided playing WoW for fear I would never stop. I disagree vehemently with my wife that watching college football all day Saturday and then NFL all day on Sunday is excessive. 
Labels