This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Granular NetFlow retention periods?

Is the retention period for NetFlow data only available as a global setting or is it more granular than that?

Also, with the Flow Storage DB set up on a different server, what impact does increasing or decreasing your retention period have on SW or NTA as a whole?

  • The retention is global, there is no roll up in netflow the way there is for other Orion modules, its down to the minute until it hits the limit and then they drop it.  The type of db structure they used for NTA is pretty nice and your retention periods don't really seem to have much negative impact on the overall orion web interface.  If you started adding "top applications for the last 30 days" type resources to your views it would definitely slow the load times, but as far as I've noticed the limit is based on the specifically amount of time you are trying to display, not the total amount being stored.  So if I have 365 days of retention but my chart is only showing the last 24 hours it only seems to matter how much data is in that 24 hour slice.  Likewise if I cut it back to 5 days of retention it would still take just as long to display a 24 hour slice of data.