325
edits
Global settings: Difference between revisions
→Packet ring buffer timeouts
Remco.derooy (talk | contribs) |
Remco.derooy (talk | contribs) |
||
| Line 200: | Line 200: | ||
Two timeout settings related to the packet ring buffer can be adjusted. | Two timeout settings related to the packet ring buffer can be adjusted. | ||
* | * '''Long timeout''' controls after which maximum amount of time, a packet is actually written to the packet ring buffer. A lower value may decrease the time difference by which packets are stored out of their order in the packet ring buffer but it may increase the amount of unused overhead data in the packet ring buffer. | ||
* | * '''Short timeout''' controls after which amount of time smaller batches of packets are written to the packet ring buffer, even if waiting for more packets would result in a more efficient operation. A lower value may decrease the time difference by which packets are stored out of their order in the packet ring buffer, but it may also decrease the performance of the packet ring buffer. | ||
=== Data retention timeout === | === Data retention timeout === | ||
When | When the data retention timeout is set to a value greater than 0, data will be removed everywhere throughout the system after the given number of minutes. This means that entities like IPs, which have been inactive for longer than the timeout, will be removed. History graph data for entities that are still active will be truncated to cover only the given timespan, while the absolute values for the whole runtime will be retained. When a packet ring buffer is active, packets which are older than the timeout will be discarded. | ||
=== Multithreaded capture analysis === | === Multithreaded capture analysis === | ||