This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

"No space left on your NTA Flow Storage disk" - NTA Best practices

FormerMember
FormerMember

I'm frequently getting a "No space left on your NTA Flow Storage disk" message the NTA summary page. I check NTA storage weekly but apparently this isn't often enough. Another concern is if I am managing space correctly. My installation of NTA is about 2 months old, and our network team is systematically going through our routers configuring them to forward NTA traffic to Solarwinds. To put things in to perspective, when I installed NTA 2 months ago, 4 routers were forwarding traffic. Now it's close to 300.  I don't know how many routers we will "stabilize at" , but I do want to have a few tools under my belt so that I can proactively request additional storage for the netflow db before it runs out of space instead of after.

1) What are the best practices for configuring netflow storage so that it can scale with increased traffic.

2) How would I configure a Solarwinds alert to let me know when the NTA database is approaching it's storage limit?

Here are the apps I have installed:

Orion Platform 2016.1.5300, IPAM 4.3.1, VNQM 4.2.4, NCM 7.5, NPM 12.0, DPA 10.0.1, QoE 2.1.0, NTA 4.2.0, IVIM 2.1.2, SAM 6.2.4, NetPath 1.0 Copyright 1999-2016 SolarWinds Worldwide, LLC. All Rights Reserved.

  • 1 - The netflow storage doesn't really have a lot of configurations that you would need to do to it.  The main question mark being how fast are the physical disks that support the drive you use for storing it?  See these relevant lines from the NTA DB FAQ in the documentation website

    Q: What are IOPS requirements for NTA Flow Storage Database server?

    The following measured values can only be used as recommendations and raw estimates. The number of flows per second (fps) cannot be directly translated into inserts per second (ips) as the ratio varies for individual customers.

    @ 140 ips (inserts per second), corresponding to about 0.5k-4k fps (using 95% top talker):
    100 IOPS for reading data
    30 IOPS for storing data

    @ 30,000 ips, corresponding to about 50k-70k fps (using 95% top talker):
    1,000 IOPS for reading data
    450 IOPS for storing data

    Q: What is the maximum amount of flows per second that can be processed in NTA?

    NTA Flow Storage Database can process up to 300,000 flows per second. The load has to be distributed among multiple pollers, because one NTA poller is able to process a maximum of 50,000 flows per second.

    Note: NTA performance depends on hardware specifications of your deployment. The same is true for NTA Flow Storage Database which requires fast hard drives to achieve maximum performance.

    2 - Just add in your NTA DB server as an Orion node and make sure to check the box to monitor whatever disk the NTA DB sits on.  Out of the box there is already an alert configured to notify when any monitored disks go over 95% utilization, but you may want to adjust that threshold and it's criteria depending on the circumstances in your environment.  Many people prefer the logic to be a bit more advanced than a flat 95% threshold but it's a start.

    -Marc Netterfield

        Loop1 Systems: SolarWinds Training and Professional Services

  • Best practises are to do what suits your environment. You are obviously limited by space. I had the same problem. I used to keep a few weeks worth of Netflow data but once netflow moved onto it's own database, I was limited to file storage space. So I just kept playing around with these settings until I found a happy medium. As you can see I now only keep 7 days worth of netflows. If I had more space, I would increase this value.

    Capture.JPG