Hi John,
This is most of the time a matter of the local setup and procedures.
Running a single instance of nfcapd has the advantage of having identical
export configuration on each device - same IP/port.
On the other side, having multiple nfcapds running allows you to separate
things more cleanly and having more kernel resources availave - CPU, memory.
nfcapd is (not yet) multi-threaded, This will come in 1.7.
Not much more, but I support your views.
Cheers
- Peter
On 25.07.18 17:40, John Kristoff wrote:
> I'm curious if people tend to run nfcapd with multiple sources
> specified under an single instantiation (i.e. with multiple -n
> switches) or if the preference is to run multiple process instances of
> nfcapd and listen on distinct ports or addresses for each export source
> (or source set).
>
> It seems slightly cleaner to just run a single instance of nfcapd, but
> if there are multiple sources, perhaps there is some advantage for
> maintenance purposes, and maybe for them to each have their own socket
> buffer and possibly CPU?
>
> Interested in your experience and thoughts,
>
> John
>
> ------------------------------------------------------------------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
> _______________________________________________
> Nfdump-discuss mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/nfdump-discuss
>
--
Be nice to your netflow data. Use NfSen and nfdump :)
--
Be nice to your netflow data. Use NfSen and nfdump :)
_______________________________________________
Nfdump-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfdump-discuss
