Owners Manual

Traffic Flow Portlet | Traffic Flow Analyzer
OMNM 6.5.2 User Guide 543
which aggregate to weekly data. It is important to consider how long you need to keep each
granularity of data and to set the values accordingly. If you are saving data for longer than you need
it, then this can fill up your database.
On this screen there are also fields that help you optimize queries. You can set the maximum
number of rows per rollup table, which can be helpful for improving query performance. Also you
can determine whether or not the queries should use the cache tables. Using cache tables is faster,
but there is a possibility that not all of the detailed flow data is in the cache tables, so it is
sometimes helpful to un-check this box, which will use the raw data tables instead.
Sometimes the volume of traffic flow data collected from the exporters can overwhelm the
database. OpenManage Network Manager collects traffic flow packets (sFlow, NetFlow, IPFIX)
from the registered exporters and aggregates the data into 1-minute flows differentiated by
exporter, protocol, application, and conversation (including sender and receiver for both IP and
autonomous system). Every minute, these flow records are inserted into the database. The number
of distinct flows, differentiated by each of these fields, can sometimes add up to more row inserts
than the database can handle in a single minute. In such cases, the only way for the system to
function is for it to only insert the conversation-based flows that are the most significant (highest
byte totals) and allow for the less significant flows (low byte totals) to be aggregated into a single
flow that represents all other conversations.
This can be done through the “Max Conversational Flows Per Minute” feature. This feature is
disabled by default, but if enabled it will reduce the number of inserts to the database per minute
while preserving the most significant flows and also while preserving the overall byte and packet
totals. What this means is that if you enter a number for “Max Conversational Flows Per Minute”
then you are configuring OpenManage Network Manager to keep that many flows per minute. So
this many flows will be inserted into the database as differentiated by exporter (by equipment
manager and by subcomponent), protocol, application and conversation (sender and receiver) but
any flow above this number will lose their conversation data and will only be differentiated by the
other three fields (exporter, protocol, and application). It does this by first ranking all flows by
estimated total bytes and then taking the highest N and inserting each of these into the database as
they were reported by the device. The rest of the flows are then aggregated into the “Other”
category and inserted into the database.
For example flows with estimated total values of 3, 15, 44, 89, 248, 510, 746, 1038, 4313, and 9755
and "Max Conversational Flows Per Minute" of 5 would find the top 5 to be 510, 746, 1038, 4313,
and 9755. These flows would have their sender and receiver data (IP and AS) saved in the DB but