With regards to Toplists of Flow/Packet Sniffer sensors, is it better to reduce the toplist interval, or the top count, or a combination of both?

Article Comments

This article applies to PRTG Network Monitor 12 or later

Recommended Settings for Best Toplist Performance

A recommendation for specific settings depends on the particular load you want to reduce.

  • The main load is caused by the number of flows; this factor cannot be influenced by the configuration on your flow router/switch.
  • The Period (minutes) setting determines for how long data is collected before a toplist is generated. The longer the period, the less toplists will be generated. To ease server load, we recommend using long periods, if you can. However, more memory will be consumed when collecting data in longer periods, depending on the network and the type of toplist, since the probe collects data for a longer time span.
  • The Top Count determines how much data is forwarded from the probe to the core (this is relevant when using remote probes in a WAN) and then is to be stored on the hard disk. Thus, the top count defines the size of each individual toplist.

Conceivably, the best mix of these options regarding the performance of toplists is to add as few toplists as possible and to turn off live listing, i.e. choose the option Wait until toplist period ends in the data transfer settings when experiencing high bandwidth usage. We further recommend 15 minutes toplist periods and a top count of 50 for high loads.


Jan, 2013 - Permalink