Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Losing flows from many network devices with 1 collector #27

Closed
MIKNOTAURO opened this issue May 30, 2019 · 1 comment
Closed

Losing flows from many network devices with 1 collector #27

MIKNOTAURO opened this issue May 30, 2019 · 1 comment

Comments

@MIKNOTAURO
Copy link

Hi Guys!
I want to send flows from many routers to goflow collector and then push those flows to kafka topic, my question is as follow... Do you have any recommendation to know/calculate the relation between network devices (routers) and colletors.
Now I have 3 routers target to 1 goflow collector and I have the impression that I'm losing packages. Do you have any advice/hint ?
Btw, I'm running goflow through docker... should I need to run many containers?
thanks for your time guys ;)

@lspgn
Copy link
Contributor

lspgn commented Jun 4, 2019

Hi @MIKNOTAURO,
Which version are you using? How many flows per router? NetFlow or sFlow?
It really depends on the specs of the server.
Are the containers limited in RAM and CPU?

Decoding takes around 25uS to decode NetFlow/IPFIX packets and 75uS to decode sFlow.
At this rate, a GoFlow running on one core should be able to decode 10k-40k samples per second.
But this does not take into account the time to push the data to Kafka: which can depend a lot on your setup.

Try running it without Kafka and check the metrics.

Regarding the drop, it may be a UDP buffer too small.
I'd suggest to monitor the following:

# netstat -su
Udp:
    xxxx packets received
    xxxx packets to unknown port received
    xxxx packet receive errors
    xxxx receive buffer errors

should help.

Thank you

@lspgn lspgn closed this as completed Jun 11, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants