[netflow-tools] flows timers control

[alex k]

> Hi
>
> I use softflowd simultaneously with my router. I noticed that softflowd
> is generating almost twice more softflow info than my cisco. I guess
> thats because of timouts which I am able to set on cisco and use some
> cache before sending netflow information to my collector.
> Is it possible to set it also with softflowd? In other words:
> - generate netflow information when flow is not active for X seconds (I
> want to set X value, what is softflowd default?) (cisco: |ip flow-cache
> timeout inactive X)|**
> - generate netflow information when flow is active for Y seconds (and if
> still active repeat this after another Y seconds (what is the default?))
> (cisco: *ip flow-cache active-timeout Y)
> I guess that softflowd timers are different than cisco ones, I probably
> get more detailed info with softflowd but I am running out of resources
> and just need to save on this.
>
> Any ideas?
>
> Regards
>
> S.M
> *
> _______________________________________________
> netflow-tools mailing list
> netflow-tools at mindrot.org
> https://lists.mindrot.org/mailman/listinfo/netflow-tools
>

Hi S.,

I'm not sure, if I understand your problem as I don't have experience with
cisco routers. Running out of resources probably means memory (or cpu?).
Softflowd has several timeouts. See "man softflowd", section "Timeouts".
The one you are searching for might be "maxlife".
Try something like "-t maxlife=5m". Then all flows will be expired after 5
minutes (sent to collector).
Alternatively you could reduce the maximum number of flows to concurrently
track with "-m" or the track_level with for instance "-T proto" (less
detailed, but less resources needed).

Hope this helps.

xela