[c-nsp] 6500 NDE CPU load

[Jared Mauch]

On May 30, 2008, at 5:42 AM, Phil Mayers wrote:

> We have a netflow collector from a Large Software Vendor on loan.
>
> Said vendor waltzed in and coolly dropped into the conversation  
> "yeah we'll be needing you to drop your flow timers to 60 seconds,  
> including the "active flows" timer, else we won't get good results"
>
> I was... less than impressed.
>
> So I've been doing some statistical analysis of the distribution of  
> flow ages and packet counts; once i've got the results, how can I  
> predict the effect on CPU usage of a flow timer decrease?

there's a number of variables you should watch.  please take the  
following with a grain of salt YMMV, etc..

Depending on your export options, you will need to watch your SP cpu  
utilization (as well as any DFCs).  This may impact how responsive the  
SNMP subsystem is.  Don't utilize the software-based sampling.  This  
can drive the cpu load higher as well.  You may see variations in  
performance depending on software revisions as well as adjusting the  
mls flow timers.  Exporting the ASN data as well will cause additional  
cpu hits, and with more aggressive flow timers, you should expect the  
natural fallout from this.

	- Jared