What is the resolution timeline of NFA data?

[Anon Anon]

Hi,

 

I want to understand the netflow roll-up feature.

 

1 min resolution data present how long?

15 min resolution data present how long?

4 min resolution data present how long?

8 hours esolution data present how long?

........................

Please let me know.

Regards,

Mukul

[Anon Anon]

Sorry it will be 4 hours

[Kahlil Thomas]

Mukul,

 

NFA only contains realtime data, 1-minute resolution data, and 15-minute resolution data. There's no 4 hour or 8 hour data at all.

 

Please see the following page for a description of the default data retention settings.

https://wiki.ca.com/display/NFA931/Data+Retention

 

By default:

When data retention determines it is time to prune, the service deals with three main categories of data to prune:

1. NetFlow Archive Data – “Raw” NetFlow data, including NetFlow template data (.nfa and .nta files). Typically keep 24 hours of this data.
2. Reaper Archive Data – 1-minute summarized data (.rpa files). Typically keep 30 days of this data.
3. Historical Archive Data – 15-minute summarized data (.rpa15 files). Typically keep 1 year of this data.

 

 

 

 

 

If you want to modify these defaults, the following doc describes how to configure the Data Retention settings:

http://www.ca.com/us/support/ca-support-online/product-content/knowledgebase-articles/tec594705.aspx

 

 

Thanks,

Kahlil Thomas

[Kahlil Thomas]

Furthermore, within the 15-minute data points not all data is retained for the entire year. Please see the "Data Lifespan" section on the following page:

15-Minute Data - CA Network Flow Analysis - 9.3.1 - CA Wiki

 

Data Lifespan: Each data type has a default maximum storage period, as shown in the following list:

• Overall traffic: 372 days or 12.4 months
• Protocols (Top 100): 372 days or 12.4 months
• Hosts, Protocol-Hosts, and ToS-Hosts: 67 days
• Conversations (Top 50), Protocol-Conversations, and ToS-Conversations: 67 days
• ToS and ToS-Protocols: 372 days or 12.4 months
• AS: 100 days

[Anri Aburjania]

Hello,
Your replay is helpful.
Thank you.
Can you please update link?

[David Michel]

nfa was moved to the netops forum, so most likely you will have to post this there. 
https://community.broadcom.com/enterprisesoftware/communities/communityhomeblogs?CommunityKey=671164c3-e575-4b08-96ab-edc2e1ceed13

------------------------------
Support Engineer
Broadcom
------------------------------