Wanguard 6.2 User Guide
Configuration » General Settings » Graphs & Storage
Configuration » General Settings » Graphs & Storage
A very important initial step in configuring Wanguard is to make sure that the server(s) the software runs on
have enough resources to process and store IP graphs, flows and packet dumps. Storage-related settings can be
tuned by editing Configuration » General Settings » Graphs & Storage.
In a later chapter, you will be able to configure the Sensors to generate traffic graphs, tops and accounting
data for every IP that belongs to the monitored network. If you intend to use this feature, you may want to change
the default IP storage settings, as changing these later will reset all existing IP graphs, tops and accounting data.
The
Sensor Top N
value (default: 20) specifies the maximum number of items stored for ordered sets of
data, such as top Talkers, External IPs, ASNs, Countries, TCP/UDP ports, IP protocols, and so on.
The Packet Sensors save packet dumps on the local disk in the path configured for
Packet Traces
. The Flow
Sensors save flow data on the local disk in the path configured for
Flow Collectors
. When the Console is not installed
on the Sensor server, export these paths towards the Console's file system using an NFS share (
). If you
do not, the Console is not able to display data saved on remote servers.
All graph files are stored by the Console server, in the
Graphs Disk Path
. Graph files are optimized for storing
time series data and do not grow over time. All IP graph options described below have a direct impact on the storage
space required on the Console server.
The
Graph IP Sweeps
option prevents creating IP graph files for IPv4 and/or IPv6 addresses that receive
traffic without sending any traffic in return. Do not set it to “Off” when monitoring unidirectional links or asymmetric
traffic.
The size of each IP graph file is listed on the bottom of the window in the
Disk space required for each IP
graph file
field. When Sensor Clusters are not used, the maximum number of IP graph files that could be generated
can be calculated with the formula: ((number of Packet Sensors) + (number of Flow Sensor interfaces)) x (number of
IPs contained in subnets with IP Graphing set to “Yes” in the IP Zone).
There are 2 mutually exclusive methods for creating and updating IP graph files, so select the appropriate
one for your setup:
●
Create & update IP graph files directly on disk
– This method optimizes the long-term storage of IP
graph data by allowing up to 3
Round Robin Archives
. The values within the
Round Robin Archives
determine the granularity of the graphs and the interval of time they are saved.
These entries specify for
how long, and how accurately data should be stored. A smaller data average (5 seconds minimum)
generates a very accurate graph, but requires more disk space, while a bigger data average is less
accurate and uses less disk space.
On non-SSD drives, the disk seek time may be too high to update thousands of IP graph files every few
minutes. If this is the case, configure the
RRDCache daemon
to increase the I/O performance of the
Console server (
). If the speed of updating IP graph files is not fast enough, consider the
method below.
●
Update IP graph files in RAM or SSD
– This method is not optimal for long-term storage because it
allows a single Round Robin Archive per IP graph file. The files are created and updated in
Graphs RAM
Path
, and moved periodically onto a larger, albeit slower disk. Select this method when the previous
method configured with RRDCached is not fast enough to sustain updating thousands of very high-
- 20 -
Summary of Contents for wanguard 6.2
Page 1: ......
