What is this?

This knowledgebase contains questions and answers about PRTG Network Monitor and network monitoring in general.

Learn more

PRTG Network Monitor

Intuitive to Use. Easy to manage.
More than 500,000 users rely on Paessler PRTG every day. Find out how you can reduce cost, increase QoS and ease planning, as well.

Free Download

Top Tags


View all Tags

How many flows per second can PRTG handle in its flow (NetFlow, sFlow, jFlow) sensors?

Votes:

0

I would like to know more about the limits of PRTG when it comes to evaluating flow streams received from my devices (Cisco, HP, Juniper, and others). Are there any special system requirements?

flow jflow limits netflow sflow stream system-requirements

Created on May 31, 2011 11:16:22 AM by  Daniel Zobel [Product Manager]

Last change on Dec 2, 2021 9:20:55 AM by  Maike Guba [Paessler Support] (2,404) 2 1



1 Reply

Accepted Answer

Votes:

0

This article applies as of PRTG 22

The number of possible flows

The total number of flows that PRTG can process in flow sensors is not easy to determine because this depends on a lot of different factors. In contrast to traditional flow collectors, PRTG processes all incoming flows in real time.

Different factors

The number of flows that PRTG can handle mainly depends on raw CPU power and memory as well as the complexity and number of flow sensors that you use. Disk performance is not important.

Calculate number of flows

To get some numbers, we did tests on a 3 GHz quad-core system.

With a single NetFlow v5 sensor without any include or exclude rules, the system was able to handle around 150,000 flows per second.

If you use multiple sensors, you must divide this number by the sensor count. This is because each sensor individually processes the flows.

PRTG uses a multi-threaded architecture for flow processing. So, you can multiply the number of possible flows calculated for one single core by about half the number of your system’s CPU cores (for example, number * 2 for a quad-core system).

Sample calculation

With 100 flow sensors, we got about 3,000 flows/second on our test system: 150000 / 100 Sensors * ( 4 Cores / 2 ) = 3000

Note: All include rules, exclude rules, or channel rules for all sensors are processed in real time. If you have very long or complex rules, processing can be considerably slowed down (in the example above, we used an include rule with four IP filters in every sensor).

How to write performant filter rules

Rules are processed from left to right and a short circuit evaluation is applied:

  • In multiple OR evaluations, start with the most likely conditions.
  • In multiple AND evaluations, start with the least likely conditions.
  • Use brackets to give hints for fast evaluations.

As a general rule, the CPU load on the probe system should not be above 80% to prevent packet loss. If you need more sensors than a single system can handle, consider using a remote probe. You can then configure your router to send the flow stream to both probes (the local and the remote probe) and distribute the flow sensors among the different probes.

Created on May 31, 2011 11:17:02 AM by  Daniel Zobel [Product Manager]

Last change on Jan 17, 2023 7:10:22 AM by  Brandy Greger [Paessler Support]




Disclaimer: The information in the Paessler Knowledge Base comes without warranty of any kind. Use at your own risk. Before applying any instructions please exercise proper system administrator housekeeping. You must make sure that a proper backup of all your data is available.