This article applies as of PRTG 22

The number of possible flows

The total number of flows that PRTG can process in flow sensors is not easy to determine because this depends on a lot of different factors. In contrast to traditional flow collectors, PRTG processes all incoming flows in real time.

Different factors

The number of flows that PRTG can handle mainly depends on raw CPU power and memory as well as the complexity and number of flow sensors that you use. Disk performance is not important.

Calculate number of flows

To get some numbers, we did tests on a 3 GHz quad-core system.

With a single NetFlow v5 sensor without any include or exclude rules, the system was able to handle around 150,000 flows per second.

If you use multiple sensors, you must divide this number by the sensor count. This is because each sensor individually processes the flows.

PRTG uses a multi-threaded architecture for flow processing. So, you can multiply the number of possible flows calculated for one single core by about half the number of your system’s CPU cores (for example, number * 2 for a quad-core system).

Sample calculation

With 100 flow sensors, we got about 3,000 flows/second on our test system: 150000 / 100 Sensors * ( 4 Cores / 2 ) = 3000

Note: All include rules, exclude rules, or channel rules for all sensors are processed in real time. If you have very long or complex rules, processing can be considerably slowed down (in the example above, we used an include rule with four IP filters in every sensor).

How to write performant filter rules

Rules are processed from left to right and a short circuit evaluation is applied:

• In multiple OR evaluations, start with the most likely conditions.
• In multiple AND evaluations, start with the least likely conditions.
• Use brackets to give hints for fast evaluations.

As a general rule, the CPU load on the probe system should not be above 80% to prevent packet loss. If you need more sensors than a single system can handle, consider using a remote probe. You can then configure your router to send the flow stream to both probes (the local and the remote probe) and distribute the flow sensors among the different probes.