[Nfsen-discuss] when will nfsen's processing become too much?
Netflow visualisation and investigation tool
Brought to you by:
phaag
|
From: Maurizio M. <mau...@da...> - 2006-08-31 12:58:28
|
Hi, I'm observing that with 20 sources and 85 active profiles (around 15Mbytes of data per 5 min slot), if I don't do anything else with nfsen, the cpu occupation of nfsen-run will raise (at almost 100%) at HH:MM:30 (where MM is a multiple of 5) and drop again at very low levels roughly after 3 minutes. So, it looks that I still have a 2 min cushion before the system gets instable... I note that If I do something else that involves some heavy processing (like looking for the 10 top src IP addresses over the past 24 hours on the live profile...) nfsen-run's utilization stays almost continuously high, even well after the other process has terminated. It may mean that since nfsen's normal activities cannot terminate in the 5 min slot, due to a competing process, they are nicely queued and terminate when there is time later on. Question: is this the way it works? If there is a "queue" of such activities, how long can it be? and is there any way of realizing when nfsen becomes instable, in this respect? Thanks, Maurizio |