Nagios Support Forum

I found that many of NNA hard coded defaults were not allowing my folks to make good use of the tool. They had stopped using it much since it took too long to get the data to display. I have a large site, so everything is always slow when you look at too much data. You need to take smaller bites with large data. So I have finally taken action to make things a little better. I have changed some defaults in the code. yup... again...

Defaults such as the 24 hour view on the opening screen. It seems that 24 Hours was a hard coded setting in many places. What works best for me is a small time frame with the option of stepping up to larger time intervals if needed. I read every NNA forum post to see and learn what I could do.

After reading all the forum posts for NNA I found that there were some
php files posted. https://support.nagios.com/forum/viewto ... 60#p153791
and a javascript file https://support.nagios.com/forum/viewto ... 70#p159516
I read them and liked what I saw. So I used those files, and made some minor changes that work for me. I set the default Dashboard Data selection time to 2 hours. The default was 24. I also changed the default selection display time for the Sources screen. And added some other times to the selection tool. I can now select 2, 4, 6, and 12 hours along with the other choices for 24 hours, 2 days, and so on. This has helped get NNA to a good place for me. I think folks at my site are going to be pleased.

Before these changes, I needed to reduce the retention time for flow data down to 12 hours. That was how I controlled the default screen display interval. It took too long for screens to open with a 24 hour default. But the result was less data. Now, with a 2 hour default set, I find that I can go back to the initial setting of 24 hour flow retention, or higher.

I do not care for the default directory structure where flows are stored as all the files are in one flat location, separated by source, but flat. I would prefer the year/month/day directory structure. I hope for that to be a user selected option in a future version. Long term storage of flow data, and finding what you want, is the issue. Look at man page for nfcapd at the -S parameter.

Please examine these files I am attaching and consider incorporating the changes in a future version. Unless you have already done that.

In any case, I think users running NNA 2.2.3 will find these updates to be very useful. They make NNA usable for me. (see attached zip)

Thanks

Steve B

Steve, thanks for the feedback and improvements! We really appreciate it! We will look into getting them into the next release of NNA. I already created a task for it (TASK ID 12002).

I was trying to figure out how to get nfdump working better. Where better means faster.

Found this.
https://github.com/toringe/flows
In case that helps out down the road. Maybe as an interim performance boost. I have no idea if it can be integrated to NNA but it looks promising.

Also, I have been able to increase my retention time out to a week now since I made those updates to php. I didn't invent the changes, I used the files from the forum and tweaked them a little. But now, I can grow a good history of flow data. In a painless way.

Thanks

Steve B

I have no idea if it can be integrated to NNA but it looks promising.

I believe it's worth looking into it. Thanks again!

Sorry to ping this again. I just wanted to provide one last url to GNU Parallel
https://www.gnu.org/software/parallel/

That's all... feel free to close this now if you like. Other wise I'm liable to keep adding stuff.

Thanks

Steve B