Use this window to configure advanced settings for the NetFlow flow collection and to limit resources used by NetSight Flow Alarm handling. You can access the window from the NetFlow Collection view in the Console options.
Click areas in the window for more information.
NetFlow Settings
- Throttle Flows When Count Exceeds Max By (Percent)
- Flow collection will be throttled when the Maximum Flows to Maintain in Memory is exceeded by the percentage entered here.
- NetFlow Socket Data Size
- The socket data size in bytes. Typically, this setting should not be changed.
- NetFlow Socket Buffer
- The buffer size (in bytes) that will be set aside by the NetSight server for buffering incoming flows.
- Socket Receive Queue Size
- Network packets are retrieved from a datagram socket and put into a fixed-size queue for decoding into flow records. The queue can overflow if the receive rate exceeds the decoding rate. This option allows you to configure the queue size (number of network packets).
- Worker Thread Queue Size
- Decoded flow records are put into one of several fixed-size queues for processing. These queues can overflow if the decoding rate exceeds the processing rate. This option allows you to configure the queue size (number of flow records).
- Flow Collector Filter
- Use this field to filter all incoming flows as they are processed by the flow collector. Flows not matching the filter are discarded and not maintained in memory on the server. If you add a filter here, the current flows stored in the cache will be trimmed to only matching flows. This is useful if flow collection is to be used to look for specific results, and unrelated flows do not need to be processed. An example of this might be to only process flows pertaining to a particular subnet.
NetFlow Alarm Dispatcher Options
When a flow matches an alarm definition, the match is moved into the Flow Alarm queue for processing by the NetFlow Alarm dispatcher, which gathers additional data and then generates the alarm. A specified number of matched flows are taken from the queue and processed once each service period, according to the option values specified here.
- Flow Alarm Queue Service Period
- This controls how often the queue is checked for matched flows to process. The dispatcher runs once every service period. So by default, the dispatcher processes matches every 5 seconds.
- Max Flow Alarms Serviced each Period
- The maximum number of matched flows pulled from the queue for processing each service period. By default, the dispatcher processes 100 matches every service period.
- Max Flow Alarm Queue Size
- The maximum number of matched flows that can be queued. By default, the dispatcher drops matched flows after 1000 matches are queued.
For information on related windows: