5 Replies Latest reply on Dec 22, 2015 2:56 PM by borgan

    Netflow Database Question

    aday

      I'm a network guy who is coming into an established environment tasked with getting more useful data out of the current Netflow. I would like to understand the output of what is highlighted below before I get too carried away with configuring more equipment to push flow. Please forgive my lack of knowledge on the DB side of the house but I can't really find a reason as to why I am getting this output. After talking with coworkers I understand that all of the defaults were accepted during setup and that the server where this database is located at is only used for netflow. Let me know what you think. Thanks.


      NTA Version: 4.1.1

      Netflow DB.PNG

        • Re: Netflow Database Question
          borgan

          That is a normal message indicating that your Flow Storage Database (FSDB) is maxed at capacity based on the 30 day retention period. Your DB size will stay at 8 GB while the oldest data is continually deleted. If your Average received flows per second were greater, then so would be the DB size.

           

          Does that help?

          2 of 2 people found this helpful
            • Re: Netflow Database Question
              aday

              I'm not really sure what to ask. Is this message truly normal or is it telling me to do something? When I go to the Orion Demo website and hit their calculate button this message is not generated...

                • Re: Netflow Database Question
                  borgan

                  The message is indeed normal. I suspect that the message may not actually function on the demo site.

                   

                  One more thing to keep in mind if you eventually plan to increase the flows you send to NTA. You should use the following formula to determine how much storage you will need to store the flow data for the default 30 day period:

                   

                  Size = 20 GB + (8 GB per 1000 fps)

                   

                  So, start with a minimum of 20 GB then add an additional 8GB for every 1000 flows per second ingressing your NTA server. In your screenshot above, you show an average of 311 fps during the last 5 minutes and 232 in the last 24 hours. If you use a rounded value of 300, then you would need 20+(8*0.3) = 22.4 GB of storage for 30 Days. Keep in mind that your flow profile is very tiny right now, so you are not even using 50% of that amount. Also, you can see that if you increase the flows tenfold, you will need 10 times more storage. If you decide to keep the data for 90 days, you will need to triple the storage, and so on.

                  1 of 1 people found this helpful