anyone know if this can be done or is a feature request?
Please migrate to NTA 4.0 or higher (4.0.2 recommended) on 64 bit OS. It stores data into proprietary Flow Storage Database, keeping 1-minute granularity throughout whole retention period.
Is it possible to keep say 240 mins uncompressed netflow data, then it compress to hourly for 14 days, then compress to daily after 14 days or similar?
Is there a setting already that i can use to set this up?
As Ondrej noted, the preferred approach is to upgrade to NTA4 and implement the Flow Storage Database; however, if you're still using SQL Server to store flow data, you can configure two options:
- Keep uncompressed data - allows you to configure how long detail data is kept before being aggregated and compressed. The default value is 60 minutes, but this can be extended to 240 minutes. Warning: Extending the duration of retention of uncompressed data will have a significant impact on the size of the SQL Server database holding flow data. Be sure you have adequate disk space available, and I would suggest manually growing the database size prior to making the change rather than allowing the database to autogrow.
- Keep compressed data - allows you to configure how long the daily aggregated/compressed data is retained. If you don't use historical flow data, reducing this value can mitigate the size increase requirements that will be created by extending the uncompressed storage period.
These settings are found in the Database Settings grouping in NTA Settings, and are documented in the Configuration Compression and Aggregation Settings section of the NTA Administrator Guide.