This happens if PRTG is not able to process the incoming flows fast enough. To process a flow PRTG has first to check the include and exclude filter and then all the rules used for the channels.
Depending on number of flows per second, complexity of the rules and processing power of the probe system the error then might be triggered sooner or later.
Try the following to resolve the issue:
- Make sure no other process is degrading the system performance.
This can be scheduled tasks (like backup or a virus scan) overloading the probe to specific times or events like a seach engine scan on your webserver.
The system health sensor of PRTG can help here. Create a process sensor if you suspect a specific process.
- Check the complexity and number of rules you use
If you are using very long filter expressions try to optimize them for faster evaluation. Put the most likely matches first, use brackets to structure the rule, use ip ranges and masks instead of seperate IPs.
- Check your toplists
Toplists take a lot of processing power too and can block the core-probe communication. Delete all toplists you do not necessarily need. Toplists with less fields are preferable. Disable "live" toplists where not required.
- Use a remote probe on a seperate machine
Best performance can be achieved with a physical (non virtual) system with 4 (or more) cores. Each sensor has its own flow processor using a thread so more cores help if you have a lot of (flow-)sensors.
- Use multiple remote probes
Separate the load on multiple machines. If you have multiple routers send the flow streams to different probes, if you have one router you can send the same stream to two probes with half the sensors.
Add comment