Nagios Support Forum

Just wanted to check in again to see if there have been any progress on this?

jdalrymple wrote: jolson and I are both convinced that this is not a problem you can just throw hardware at to solve and we're eager to find a solution that scales better so that we can be ahead of other future potential customers finding out our software can't perform in high demand environments.

You're not alone anymore - we've had at least 2 more customers indicate similar issues.

jdalrymple wrote:I would say we're about 50-75% through making a functional *theoretical* test bed.

We made it to 100% here. I have a test machine storing NNA data in a different type of database that is much better structured than the nfcapd binary files and it can run queries orders of magnitude faster in some circumstances. Unfortunately we also found there are some circumstances where it doesn't perform as well as the current solution, this is due to some missing optimizations in the aggregation functions. Again...

jdalrymple wrote:I wouldn't necessarily say we're working hard, we're just fitting it in where we can.

I've been working with external developers and additionally digging into the code myself to try to find the optimizations, it's an arduous process though - especially me being pretty inept when it comes to manipulating structured data.

Truth be told myself and jolson are probably at a place where we could present a case for the developers to dig into the problem based upon our findings using alternative storage methods, now isn't the time to approach them about it as they're working hard on the next major XI release. Hopefully after the conference and XI release (order isn't intentionally implied there) we will have a bit more for them and they will have some time for us.

Hi There,

I was wondering if there's anyway to override the default view of 24 hours to 2. This way if users click on any IPs or access the sources, it won't try to load 24hours be default. If this can be done, then at least I can provide a more usable interface for now.

Thanks.

I'll take a look on Monday and see what it will take.

I've set it up to default to 2 hours, this is for 2R1.0.

*** Note: This will get reverted if you upgrade and will need to be reimplemented.
*** Make sure that you have known-good backups/vm snapshots before making any modifications

Unzip the attached file and replace these files:
Let me know if you have any questions.

We are experiencing this exact same issue and have come to the same conclusion; the nfdump process is not multi-threaded and is only using 1 CPU. I would like to change the default to 2 hours. In the zip file in the post above, there isn't a
home.php file, is this file needed?

Sorry about that, here it is with the home files included:

Cool thanks. I copied all the files and it indeed defaults to 2 hours. It's a lot faster, not as snappy as I'd like but a heck of a lot quicker than before. Do you have a timeline for the fix to this issue?

No ETA available, it's up to the developers at this point and I'm not sure where it sits on their priorities.

When I click on Sources then the source then the queries tab, it defaults to 2 hours like it is supposed to, but then if I run a query, it tells me "you must enter a time range".

Perhaps missing something?