9 Replies Latest reply on Jun 3, 2009 1:12 PM by r0berth1

    Performance Issues / Feature Request

    wtan2000
      We have been long-time users of Orion, and have had Netflow running for 3 months.  Unfortunately, the only way we've  been able to get respectable performance is to throw hardware at it.

      My feature request involves having more flexibility in the data consolidation engine so that we can keep the size of the database or indices down.  As an example, I'd be ok with consolidating entries  to the hour almost immediately, or aggregating IP addresses into /24s after a day, etc.  Or maybe the database architecture can be made to be more efficient.

      For those who are interested, we are monitoring about 15 T1 interfaces, have a 60 day retention, and are consolidating aggressively.  Our database is about 150GB.  Here are the SQL server specs that got us acceptable performance:

      1xClovertown 1.67ghz quad core processor
      8xSAS15K drives striped
      16GB DDR2 ECC667 RAM
      Windows R2 Enterprise, SQL 2005

      That may sound over the top, but lesser servers haven't cut the mustard as evidenced by high disk queue times in Windows perfmon.  It's all about the number of high-speed disk spindles you can dedicate to it.