3 Replies Latest reply on Dec 6, 2011 10:24 AM by jswan

    How many flows can NTA process when 'Top Talkers Optimization' is off

    Tomoki

      Hi there,

      I would like to capture an illegal conversation. However this is not always make many conversations so that I need to use NTA without Top Talkers Optimization. On the other hand, when the Optimization is off, NTA may lost or delay.

      Please let me know in case with recommended hardware, how many flows can NTA process when 'Top Talkers Optimization' is off.

      Regards,

      Tomoki

        • Re: How many flows can NTA process when 'Top Talkers Optimization' is off
          jswan

          I don't think top talkers optimization affects the flows-per-second that NTA can process; rather it has to do with how much data is retained in the database. This in turn affects read performance from the database. If you turn it off, your read performance plummets if you have a lot of flows.

          Some things you could try:

          1) Turn off TTO and accept bad performance until you find the flow you're looking for, then turn it back on after you solve the problem.

          2) Set TTO to 99% instead of the recommended 95% and see if the flow you're looking for can be found in the top 99%. My experience has been that a value of 98% or 99% still results in big performance gains versus turning it off.

          This is an area where I really hope Solarwinds can make some big improvements in upcoming releases. The lack of full flow retention (with decent performance) and lack of access to raw flows makes the tool less than desirable for security and forensic work.