Phil 1. ntopng keeps in memory hosts as long as they are active 2. idle local hosts are then purged from memory and put on redis for some time. This allows them to be restored if they make traffic again within 1h or so
it looks to me that you have not configured with -m the local network. is this the case? This said what do you need exactly: ability to keep in memory all local hosts only, right? Please file a bug request on http://bugzilla.ntop.org Regards Luca On 15 Nov 2013, at 22:23, Newlon, Phil <[email protected]> wrote: > I have a linux system running ntopng 1.1_6932 and a Win32 system running > nprobe 6.15.131114. The probe sends zmq flows to the Linux ntopng device. > > - The ntopng system has been up for 5:17:49 > - The probe was started first by about ten seconds > - I have ~1375 remote hosts that check in with the server where nProbe is > running, every five minutes > > I would expect that the 'First seen' for all those hosts would be something > like 5:18:00 to 5:23:00 since the start of the system but they vary from 2-3 > minutes ago to 20-30 minutes ago though a few are several hours old. When I > search the hosts for a system I know has checked in I see " Perhaps this host > has been previously purged from memory or it has never been observed by this > ntopng instance". Is there a way to NOT purge hosts? I focused on one host > in particular and it showed up in the ntopng hosts right after I saw it on > the server via windump but was purged out of ntopng stats before its next 5 > minute check in. I would like to have persistent data about all hosts over > time, hopefully this is possible? > > Thanks! Phil > > > Example: > IP Address 10.25.86.167 > Name 10.25.86.167 Remote Private IP > First Seen 15/11/2013 15:35:17 [23 min, 29 sec ago] > Last Seen 15/11/2013 15:58:14 [32 sec ago] > > (c) 1998-2013 - ntop.org > Generated by ntopng v.1.1 (r) for user admin and interface > [email protected]:5556 > 222.63 Kbps [82 pps] > Uptime: 5 h, 17 min, 49 sec > > Notice: This e-mail message and its attachments are the property of The > Wendy's Company or one of its subsidiaries and may contain confidential or > legally privileged information intended solely for the use of the > addressee(s). If you are not an intended recipient, then any use, copying or > distribution of this message or its attachments is strictly prohibited. If > you received this message in error, please notify the sender and delete this > message entirely from your system. > _______________________________________________ > Ntop-misc mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop-misc _______________________________________________ Ntop-misc mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-misc
