[flow-tools] performance question

[Mark Fullmer]

flow-nfilter does not do any caching.  It does potentially use a lot of
memory to implement fast datastructures though.

mark

On Mon, Jan 20, 2003 at 01:30:16PM +1300, Vanish Pattni (DSL AK) wrote:
> I was developing some things on the flowscan tools that Dave Plonka wrote. I
> am sure that flow-nfilter issue is similar to mine where I am doing
> filtering of flow traffic based on the veriables the Cflow exposes (BTW this
> is all in perl but the logic is the same).
> 
> In a nutshell my problem was paging. I was doing caching and after I had hit
> the physical mem limit the cpu dropped from 100% down because the machine
> would start to page horribly.
> 
> So in my opinion it could be the paging. Monitor that and see if that
> applies in your case - I could be easily wrong ($0.02)
> 
> Vanish
> 
> -----Original Message-----
> From: Systems Administrator [mailto:sysadmin@sunet.com.au]
> Sent: Monday, January 20, 2003 11:44 AM
> To: fin@finseth.com; flow-tools@splintered.net
> Subject: Re: [flow-tools] performance question
> 
> 
> ----- Original Message ----- 
> From: "Craig A. Finseth" <fin@finseth.com>
> To: <flow-tools@splintered.net>
> Cc: <craig@finseth.com>
> Sent: Saturday, January 18, 2003 7:09 AM
> Subject: [flow-tools] performance question
> 
> 
> > 2) Over 50% of the total wall clock time is spent in flow-nfilter.
> > This step involves producing a flow file for each customer that
> > contains only flows to or from that customer.  The source of data for
> > this step is the set of flow files that contains data from all parts
> > of the network merged together.  The CPU is about 40% busy during this
> > step.  A typical filter file is:
> 
> 
>     So where's the bottleneck on this one?  Disk?  Memory?  
> 
> Tim Nelson
> Systems Administrator
> Sunet Internet
> Tel:  +61 3 5241 1155
> Fax: +61 3 5241 6187
> Web: http://www.sunet.com.au/
> Email: sysadmin@sunet.com.au
> 
> 
> _______________________________________________
> flow-tools@splintered.net
> http://www.splintered.net/sw/flow-tools
> 
> _______________________________________________
> flow-tools@splintered.net
> http://www.splintered.net/sw/flow-tools