Longterm DB
Description
The Longterm DB feature (in firmware >= 4.3) uses an attached storage devices to store traffic information of IP addresses with low resolution for a much longer time than the live statistics.
The stored data comprises the IP addresses and their traffic data in graphical representation with 5 minutes resolution.
The storage is used similar to a swap file mechanism so the longterm data is not kept between restart unless the DB persistence feature is enabled too, which is recommended when using the longterm feature. To reduce the amount of time to dump/restore, the DB persistence configuration allow to skip storing live data.
Usage
If this feature is enabled, a view toggle button appears in the top menu bar. This button allows to switch between the "LIVE" view and the longterm ("LT") view.
In the longterm view, the IP address information contain only information about the traffic amount in 5 minute resolution.
Other data is still shown if available from the live data base. To highlight the difference, the live graphs are shown in light gray background (and a larger gray background indicates the limit of back-in-time view in the live data).
The example screenshot to the right shows the differences. The IP addresses are available for multiple days, while the MAC address and L7 protocol data comes from the live data and is only available for a few hours.
Having both data views available at the same time helps to navigate through the time and directly see which kind of data is available.
Setting
The configuration can be found in the global settings page in the "Longterm DB" tab.
To enable this feature, select a storage device to be used, enable the feature and enter a file size.
It is recommended to also enable the DB persistence feature to be able to save and restore the longterm DB data during restarts.
Once enabled, the utilization of the file is shown and the System Info Page contains information about how long the data can be kept.
Tip: Since the amount of information stored in the longterm DB is limited by the graph resolution, the file size usually don't need to be similar sized as the main memory. 10 GByte is a good starting point.
The size can be increase but it requires a restart of the packet processing.
Notes
Recommended storage device types:
| Storage device | Note |
|---|---|
| NMVe based SSD | recommended |
| SATA based SSD | can be used for moderate traffic, check system load for high system utilization |
| USB based SSD | not recommended, but might be useful for small systems (Allegro 200/500) |
| HDD | not recommended, should not be used |
It is also not recommended to place the longterm DB on the same storage device that is used a packet ring buffer as it will deteriorate the performance of both features.
Limitations
- The data in the longterm DB comprises the following information:
- IP addresses
- activity time
- traffic graph in 5 minute resolution
- IP addresses
- The data is written into the longterm DB in variable intervals depending on traffic and system load. It takes up to 10 minutes (two graph intervals) until the data appears in the graph. Therefore, the last 5-10 minutes appear empty or with less traffic than in live view.