Flow Monitor Settings

How to get here

Use this dialog to configure general settings for Flow Monitor.

Enter or select the appropriate information in the following fields.

General

• Listener port. Enter the TCP/IP port number over which the Flow Monitor Collector service should listen for Flow information.

Note: If you change the listener port from the default, you may have to add an exception to the firewall if you are using the Windows Firewall.

• Log level. Select the level of details you want to write to the log.
  • Normal. Select this option to record errors and some general event information.
  • Verbose Logging. Select this option to record more detailed information than normal logging. This option can create a very large file and may be resource intensive, however, it is especially helpful for troubleshooting issues.
  • Errors Only. Select this option to record only events that register as errors.
• Enable informational tooltips. Select this option to enable Flow Monitor to display tooltips with information about possible problems and other information about report details.
• Get favorite icons. Select this option to allow Flow Monitor to retrieve and display favicons (favorite icons) from hosts and domains when they are provided.

  Note: If you select the Get favorite icons option, Flow Monitor will make connections to a host in the domain to retrieve the favicon. This will impact the connections statistics for both the host and the domain.

Report Data

Important: For recommended settings based on your network's size and characteristics, see the WhatsUp Flow Monitor Performance Tuning Guide.

• Data collection interval. Select how often Flow Monitor writes collected data from its sources to the database. You may select 1, 2, 3, 4, 5, or 10 minutes. By default, data is written to the database every 2 minutes.

  Note: Modifying collection interval settings affects the granularity you see in Flow Monitor reports. If the interval is set to 5 minutes, you cannot distinguish traffic collected during the first minute from traffic collected during the fourth minute.

• Roll up raw data after. Enter the number of hours after which raw data collected from your Flow devices should be rolled up. This setting determines the number of hours of raw data that can be reported on at any given time. After data has been rolled up, Flow Monitor can report data usage for each hour, but detailed granular data (such as bytes, flows, and percentages) is aggregated into a single value for the entire hour. By default, raw data is rolled up after 4 hours.

  Caution: Modifying the roll-up settings directly affects the size of the Flow Monitor databases and the performance of the application. We recommend that you modify these settings cautiously, monitoring the effects on database size and application performance.

• Roll up hourly data. Enter the number of days after which hourly data should be rolled up into daily data. After hourly data is rolled up, Flow Monitor can only report aggregated totals for entire 24-hour blocks of time. By default, hourly data is rolled up after 1 day.
• Archive daily data. Enter the number of days after which daily data should be moved to the archive database. By default, daily data is archived after 3 days.
• Expire archive data. Enter the number of days after which daily archive should be purged from the archive database. By default, archive data is purged from the database after 7 days.
• Resolve private address interval. When the Flow Monitor collector service encounters an IP address, it tries to determine information about the host attached to the IP address. After this information is resolved, it is stored in the Flow Monitor database. Enter the interval (in hours) that you want Flow Monitor to wait, before it checks the private IP address again, to resolve information that may have changed for the address. By default, private addresses are resolved every 48 hours.
• Resolve public address interval. When the Flow Monitor collector service encounters an IP address, it tries to determine information about the host attached to the IP address. After this information is resolved, it is stored in the Flow Monitor database. Enter the interval (in hours) that you want Flow Monitor to wait, before it checks the public IP address again, to resolve information that may have changed on the address. By default, public addresses are resolved every 720 hours.

  Tip: Because public IP addresses are less likely to be changed, you may want to use longer intervals than used for the Resolve private address interval option.

• Expire unclassified traffic after. Enter the number of hours after which Flow Monitor should purge unclassified traffic. Unclassified traffic is traffic transmitting over ports that are currently not monitored by Flow Monitor. By default, this option is set to 0 (zero), which causes Flow Monitor to aggregate and retain data for all unclassified ports as a single value; detailed information about the individual unclassified ports over which traffic was transmitted is immediately discarded.

  Note: The collector will purge any unclassified data that has no activity after the Expire unclassified traffic after value is satisfied.

Click OK to save changes.

Important: Any changes made to data roll up intervals are not enforced until the Flow Monitor collector service is restarted. For more information, see Stopping or restarting the collector.