Configuring data roll-up intervals

NetFlow Monitor is designed to serve two primary purposes:

• To give a minute-by-minute view of recent network traffic.
• To give an overview of historical network traffic.

To accomplish these goals while keeping the size of its database reasonable, NetFlow Monitor uses a process of summarizing data at certain time intervals.

By default, NetFlow Monitor rolls up data on this schedule:

• Complete raw data (which is collected every other minute and provides the detailed view of recent traffic) is kept for 8 hours.
• After 8 hours, raw data is summarized into hourly averages.
• After 3 days, hourly averages are summarized into daily averages.
• After 14 days, daily data is archived.
• After 93 days, archive data is purged from the archive database.

You can configure the intervals to roll up data more or less frequently depending on your network's size and traffic volume.

To set data roll up time intervals:

1. From any workspace view or report in the web interface, select GO. The GO menu appears.
2. If the NetFlow section is not visible, click NetFlow. The NetFlow section of the GO menu appears.
3. Select Configure > NetFlow Settings. The NetFlow Settings dialog appears.
4. Under Report Data, customize the roll up intervals to meet your requirements.
   • Data collection interval. Select how often NetFlow Monitor writes collected data from its sources to the database. You may select 1, 2, 3, 4, 5, or 10 minutes. By default, data is written to the database every 2 minutes.

     Note: Modifying collection interval settings affects both the granularity you see in NetFlow Monitor reports. If the interval is set to 5 minutes, you cannot distinguish traffic collected during the first minute from traffic collected during the fourth minute.

   • Roll up raw data after. Enter the number of days and/or hours after which raw data collected from your NetFlow devices should be rolled up. This setting determines the number of hours of raw data that can be reported on at any given time. After data has been rolled up, NetFlow Monitor can report data usage for each hour, but detailed granular data (such as bytes, flows, and percentages) is aggregated into a single value for the entire hour. By default, raw data is rolled up after 8 hours.

     Caution: Modifying the roll-up settings directly affects the size of the NetFlow Monitor databases and the performance of the application. We recommend that you modify these settings cautiously, monitoring the effects on database size and application performance.

   • Roll up hourly data. Enter the number of days after which hourly data should be rolled up into daily data. After hourly data is rolled up, NetFlow Monitor can only report aggregated totals for entire 24-hour blocks of time. By default, hourly data is rolled up after 3 days.
   • Archive daily data. Enter the number of days after which daily data should be moved to the archive database. By default, daily data is archived after 14 days.
   • Expire archive data. Enter the number of days after which daily archive should be purged from the archive database. By default, archive data is purged from the database after 92 days.
   • Resolve private address interval. When the NetFlow Monitor collector service encounters an IP address, it tries to determine information about the host attached to the IP address. After this information is resolved, it is stored in the NetFlow Monitor database. Enter the interval (in hours) that you want NetFlow Monitor to wait, before it checks the private IP address again, to resolve information that may have changed for the address. By default, private addresses are resolved every 48 hours.
   • Resolve public address interval. When the NetFlow Monitor collector service encounters an IP address, it tries to determine information about the host attached to the IP address. After this information is resolved, it is stored in the NetFlow Monitor database. Enter the interval (in hours) that you want NetFlow Monitor to wait, before it checks the public IP address again, to resolve information that may have changed on the address. By default, public addresses are resolved every 720 hours.

     Tip: Because public IP addresses are less likely to be changed, you may want to use longer intervals than used for the Resolve private address interval option.

   • Expire unclassified traffic after. Enter the number of hours after which NetFlow Monitor should purge unclassified traffic. Unclassified traffic is traffic transmitting over ports that are currently not monitored by NetFlow Monitor. By default, unclassified traffic is expired after 1 hour.

     Tip: You can prevent NetFlow Monitor from saving data about unclassified traffic by setting Expire unclassified traffic after to 0 (zero). When this option is set to 0 (zero), NetFlow Monitor aggregates and retains data for all unclassified ports as a single value; detailed information about the individual unclassified ports over which traffic was transmitted is immediately discarded.

5. Click OK to save changes.

   Important: Any changes made to data roll up intervals are not enforced until the NetFlow Monitor collector service is restarted. For more information, see Stopping or restarting the collector.