I have a single probe/core server setup that's starting to reach it's load limit. We suspect it is the custom netflow sensors that are causing the extra load (two sensors with more than 20 channels each and large filters; data comes from 2 routers with up to 200Mbps sustained traffic). We're thinking about adding a second probe for doing the netflow collection but can't afford to lose any historical data since we use it for billing. Is it possible to: build the new remote probe; add it to the list of IPs the routers export netflow data to; move the sensor from old probe to new probe.
This seems like it would work, but I would like to know for certain before I propose adding another probe.
Add comment