[Nfdump-discuss] Re: [Nfsen-discuss] nfdump speed

[Peter H. <ha...@sw...>]

-----BEGIN PGP SIGNED MESSAGE-----



- --On March 6, 2006 11:56:46 +1100 Rudolph Pereira <ru...@us...> wrote:

| On Sun, Mar 05, 2006 at 10:41:15AM +0100, Peter Haag wrote:
| > nfdump itself is ment to be efficient in flow processing, which means it pushes your system limits,
| > whatever limit comes first.
| (I've cc-ed this to nfdump-discuss as it seems more like an nfdump q)
|
| Are there any plans to split up the flow directory by date/time or some
| other method, a la flowtools? I ask because I'm also seeing huge IO
| bottlenecks when using more than a single flow file, which is rather
| easy to do with nfsen's nice range selection :). I believe this is
| contention on reading the directory rather than the files themselves
| though (we have upwards of 30k flow files for at least one of our core
| routers), and I think the current organisation is suboptimal.

Yes - there are plans. maybe nfdump 1.5.1 or 1.5.2 or so. That's not yet decided.

    - Peter
|
| If people agree that the above is a problem, could it go on a
| todo/wishlist for nfdump?
|
| thanks



- --
_______ SWITCH - The Swiss Education and Research Network ______
Peter Haag,  Security Engineer,  Member of SWITCH CERT
PGP fingerprint: D9 31 D5 83 03 95 68 BA  FB 84 CA 94 AB FC 5D D7
SWITCH,  Limmatquai 138,  CH-8001 Zurich,  Switzerland
E-mail: pet...@sw... Web: http://www.switch.ch/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)

iQCVAwUBRAxFnP5AbZRALNr/AQFM+gQAll7yBK0dO0k+TerVec6QemosPLiZ13l8
cr05Htnyu192SLI9OsIzv5F6Di7G3VDerdlsOXLMCuZktVCKcA+bf1ZU03JxdEe2
g20c9hPNg8UWvyXu1dflXpiF9lr/DQXKbKdqbcPhSPdLQxBmJLUiXOQlyqs0+zby
EuiHt+ARpD4=
=yFeu
-----END PGP SIGNATURE-----