Flow environment best practices
This section provides recommendations for setting your flow environment.
Determine where to enable flow
SolarWinds NTA can capture and store vast amounts of flow data. To make the best use of SolarWinds NTA, use the following guidelines to make decisions about where to capture enabled flow data.
- Understand your network and identify the types of problems you want to solve by capturing flow data.
- If you are unsure of where to begin, enable flow data at the core layer, let SolarWinds NTA run for a period of time (for example, a week), and review the SolarWinds NTA resources in the SolarWinds Orion Web Console to determine if the data collected is sufficient.
- If you need more flow data, move to the distribution layer. Due to the proliferation of duplicate data, SolarWinds recommends that you do not enable flows at the access layer.
- If you want to monitor internal traffic and internet traffic, enable ingress and egress interfaces.
- To capture the entire network conversation, enable ingress and egress on the external interfaces of a single node, or enable ingress only on all interfaces on the node.
Be mindful of directionality and duplication
If your devices are configured to export NetFlow on both ingress and egress interfaces, you might see duplicate traffic in the Summary resources.
Duplicate flows can occur in the following cases:
- You have both
ip flow ingressand
ip flow egressapplied for all interfaces on a device.
- You have set
ip flow ingresson some interfaces and
ip flow egresson other interfaces.
- On your serial interfaces with subinterfaces, you have NetFlow export enabled on both the physical and logical interfaces.
Set the retention period
Retention period specifies the time for which flow data are stored in the database until they expire and are permanently deleted. The default retention period is set to 30 days.
- Click Settings > All Settings.
- Under Product Specific Settings, click NTA Settings.
- Scroll down to the Database Settings section.
- In the Retention Period field, enter the number of days after which flow data is deleted.
- In the Delete Expired Data list, select a frequency.
- Click Save.