On 22 Feb 2016, at 10:54, online264...@telkomsa.net wrote: > Using this approach I am processing around 30K to 40K flows/sec across 8 > (regionally distributed) collectors, dealing with over 1TB of IP traffic per > day. > > The servers we use as collectors are pretty old and we got new servers as > replacements. Only, my collection s/w on the newer RHEL5/6/7 kernels loose in > excess of 70% of messages send via the SVR4 IPC message queues. Unsure why > exactly. Did some hacking and debugging and it simply seems that these old > message queues are not well supported on newer Linux kernels. > > So I have been looking at Open Source replacement for my old s/w - tried a > number and like nfcapd the most. Well written, and works without an effort.. > > So my question is two fold: > > - any ideas as what the approx UDP/sec process rate of nfcapd on a new server > running RHEL6 or RHEL7 is?
I've not measured this exactly but our Netflow collectors (running nfcapd) are recording about 80-100,000 flows per second across about 17 routers and 2 Cisco ASAs with NFSen. That's just over 50M flows per 10 minute file - each about 1.2GB in size. The load average is about 5% on these machines and I've never had any reports of IO problems - the disks are normal spinning hard disks (not SSDs) and just write the data to linear files: they're copied off elsewhere to be analysed. The machines are 7 year old quad core systems running SLES11SP4. In short, we've not had an issue with performance and I'm not aware of any flows going missing from a performance point of view. - Bob -- Bob Franklin rc...@cam.ac.uk / (+44 1223 7) 48479 Networks, University Information Services, University of Cambridge ------------------------------------------------------------------------------ Site24x7 APM Insight: Get Deep Visibility into Application Performance APM + Mobile APM + RUM: Monitor 3 App instances at just $35/Month Monitor end-to-end web transactions and take corrective actions now Troubleshoot faster and improve end-user experience. Signup Now! http://pubads.g.doubleclick.net/gampad/clk?id=272487151&iu=/4140 _______________________________________________ Nfdump-discuss mailing list Nfdump-discuss@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/nfdump-discuss
