Performance Optimization Guide: Difference between revisions

Line 49: Line 49:
There are 3 scenarios where the a queue overload can happen, which are described in the following sections.
There are 3 scenarios where the a queue overload can happen, which are described in the following sections.


=== Overload at low analyzer load ===
=== Skipped packets at high analyzer load ===


This happens if the analyzers of the Allegro are in a powersafe mode and a very high and large burst of one connection arrives at the Allegro. This issue has happened at customer installations with 40G Links, an average saturation less than 5GBit/s and connection bursts above 10GBit/s. This can lead to minor packet drops as the wakeup of the analyzers is not fast enough. The solution is to use the [[#Sink Mode]] and to activate the '''Analyzer queue overcommit''' at '''Settings''' → '''Global settings''' → '''Expert settings'''. This mode allows to buffer network bursts. This mode is not available for the bridge mode.
The '''Allegro Network Multimeter''' has reached its processing limit for a current traffic when the load of one or multiple analyzers reaches 100%.


[[File:Queue overcommit.png|600px]]
There are a some options to reduce the analyzer load but it always comes with the penalty of no longer seeing the complete measurement data. You can '''disable''' some features or add a '''NIC filter''' to process only parts of the traffic.


=== Overload and high analyzer load ===
<ol>
<li>You can reduce the level of analysis at '''Settings''' -> '''Global Settings'''.<br />
[[File:Detail of traffic analysis.png|600px]]<br />
Every level reduction will reduce the amount of analyzed data and saves database operations, see [[Global_settings#Limit_module_processing]] for more details of this option. It is possible to adjust the setting so that live traffic is stored as fast possible to the ring buffer without further analysis and re-analyze parts of the recorded traffic with full analysis by using the [[Parallel packet processing]].</li>
<li>The NIC filter can be used to reduce the amount of monitored traffic. It excludes traffic from the analyzers for the cost of not-seeing all traffic of the link. See the [[Filter|interface filter]] for more details.</li>
</ol>


The Allegro has reached its processing limit for a traffic when the load of one or multiple analyzers reaches 100 %.
If no of these options are applicable, you need to upgrade the '''Allegro Network Multimeter''' to a larger model with more performance (Allegro 1000 to 3000 or 3000 to 5000).


There are a few options for reducing the analyzer load but it always comes with the penalty of not processing all data. You can '''reduce''' the statistic level or add a '''NIC filter'''.
=== Overload at low analyzer load ===


You can reduce the level of analysis at '''Settings''' -> '''Global Settings'''.
This happens if the analyzers of the Allegro are in a powersafe mode and a very high and large burst of one connection arrives at the Allegro. This issue has happened at customer installations with 40G Links, an average saturation less than 5GBit/s and connection bursts above 10GBit/s. This can lead to minor packet drops as the wakeup of the analyzers is not fast enough. The solution is to use the [[#Sink Mode]] and to activate the '''Analyzer queue overcommit''' at '''Settings''' '''Global settings''' → '''Expert settings'''. This mode allows to buffer network bursts. This mode is not available for the bridge mode.


[[File:Detail of traffic analysis.png|600px]]
[[File:Queue overcommit.png|600px]]
 
Every Level reduction will reduce the amount of analyzed data and saves database operations, see [[Global_settings#Limit_module_processing]] for more details of this mode. You can use this mode to store high packet rates into the ring buffer and re-analyze parts of it with full analytics with the [[Parallel packet processing]].
 
The NIC filter can be used to reduce the amount of monitored traffic. It excludes traffic from the analyzers for the cost of not-seeing all traffic of the link. See the [[Filter|interface filter]] for more details.


If this is not applicable, you need to upgrade the Allegro to a higher class with more performance ( Allegro 1000 to 3000 or 3000 to 5000 ).


=== Overload and not-balanced analyzer load ===
=== Overload and not-balanced analyzer load ===
546

edits