New Question
 
 
PRTG Network Monitor

Intuitive to Use.
Easy to manage.

200.000 administrators have chosen PRTG to monitor their network. Find out how you can reduce cost, increase QoS and ease planning, as well.

Free PRTG
Download >>

 

What is this?

This knowledgebase contains questions and answers about PRTG Network Monitor and network monitoring in general. You are invited to get involved by asking and answering questions!

Learn more

 

Top Tags


View all Tags


How many flows per second can PRTG handle in its xFlow (NetFlow, sFlow, jFlow) sensors?

Votes:

0

Your Vote:

Up

Down

I would like to know more about the limits of PRTG when it comes to evaluating flow streams received from my devices (Cisco, HP, Juniper, etc.). Are there special system requirements?

jflow limits netflow sflow stream system-requirements xflow

Created on May 31, 2011 11:16:22 AM by  Daniel Zobel [Paessler Support]



1 Reply

Accepted Answer

Votes:

0

Your Vote:

Up

Down

This article applies to PRTG Network Monitor 12 or later

The Number of Possible Flows

The total number of flows that PRTG can process in an xFlow sensor is not easy to determine, since this depends on a lot of different factors. In contrast to traditional flow collectors PRTG does a real time processing of all incoming flows.

Different Factors

The number of flows PRTG can handle mainly depends on raw CPU power and memory, as well as the complexity and number of flow sensors used. Disk performance is not important.

Calculate Number of Flows

To get some numbers, we did tests on a 3 GHz quad core system.

With a single NetFlow v5 sensor without any include or exclude rules the machine was able to handle about 150,000 flows per second.

If you are using multiple sensors you have to divide this number by the sensor count, since each sensor processes the flows individually.

PRTG uses a multithreaded architecture for flow processing. So, you can multiply the number of possible flows calculated for one single core by about half the number of your system’s CPU cores (for example, number * 2 for a quad core system).

Sample Calculation

With 100 flow sensors we got about 3,000 flows/second on our test machine: 150000 / 100 Sensors * ( 4 Cores / 2 ) = 3000

Important: All include/exclude/channel rules for all sensors are processed in real time. If you have very long or complex rules, the processing can be slowed down considerably (in the above 100 sensors example we used an include rule with 4 IP filters in every sensor).

How to Write Performant Filter Rules

Rules are processed from left to right and a short circuit evaluation is applied:

  • In multiple OR evaluations, put the most likely conditions in the beginning
  • In multiple AND evaluations, put the least likely conditions in the beginning
  • Use brackets to give hints for fast evaluations

As a general rule, the CPU load on the probe system should not be above 80% to prevent packet loss. If you need more sensors than a single system can handle, please consider using a remote probe. You can then configure your router to send the flow stream to both probes (the local and the remote probe) and spread the flow sensors to the different probes.

Created on May 31, 2011 11:17:02 AM by  Daniel Zobel [Paessler Support]

Last change on Feb 9, 2015 1:51:27 PM by  Gerald Schoch [Paessler Support]



Please log in or register to enter your reply.


Disclaimer: The information in the Paessler Knowledge Base comes without warranty of any kind. Use at your own risk. Before applying any instructions please exercise proper system administrator housekeeping. You must make sure that a proper backup of all your data is available.