NNA Flows per Second

[OptimusB]

Quick question. I know that some netflow analyzers out in the market has a flows per second metric on how much the system can handle. Does NNA have a tested flows per second maximum before performance degradation occurs?

[jolson]

While technically there isn't a 'maximum' amount of flows that NNA supports, there are a couple of good things to note:

The nfcapd service can run out of semaphores (semget() error in bookkeeper.c will appear in /var/log/messages)
This is an issue that can occur if you have around 127 sources collecting information. If suddenly your new sources will not start, please check your system messages log:

Code: Select all

tail /var/log/messages

You are likely experiencing this problem if you see errors similar to the errors displayed in this picture:

semaphore.PNG

Please note the 'semget' error line - this tells us that we are running low on semaphores. You can follow thisguide to increase the amount of semaphores available to Nagios Network Analyzer - we recommend using 2-4 times more than you had previously in all fields.

Besides that, the limiting factor for NNA will almost always be disk speed, since information is stored in flat files. If you have 1,000 hosts with 5MB of flow data each, you can expect that NNA is going to happily pull up data very quickly. If you have three hosts with 24GB of data each, you may have to wait awhile as the files will need to be pulled from disk to display on the Web GUI.