Cisco Catalyst 3650 Series, Command Reference Manual

Page: 434 / 1108

Usage Guidelines
Each flow monitor has a cache that it uses to store all the flows it monitors. Each cache has various configurable
elements, such as the time that a flow is allowed to remain in it. When a flow times out, it is removed from
the cache and sent to any exporters that are configured for the corresponding flow monitor.
The cache timeout active command controls the aging behavior of the normal type of cache. If a flow has
been active for a long time, it is usually desirable to age it out (starting a new flow for any subsequent packets
in the flow). This age out process allows the monitoring application that is receiving the exports to remain up
to date. By default, this timeout is 1800 seconds (30 minutes), but it can be adjusted according to system
requirements. A larger value ensures that long-lived flows are accounted for in a single flow record; a smaller
value results in a shorter delay between starting a new long-lived flow and exporting some data for it. When
you change the active flow timeout, the new timeout value takes effect immediately.
The cache timeout inactive command also controls the aging behavior of the normal type of cache. If a flow
has not seen any activity for a specified amount of time, that flow will be aged out. By default, this timeout
is 15 seconds, but this value can be adjusted depending on the type of traffic expected. If a large number of
short-lived flows is consuming many cache entries, reducing the inactive timeout can reduce this overhead.
If a large number of flows frequently get aged out before they have finished collecting their data, increasing
this timeout can result in better flow correlation. When you change the inactive flow timeout, the new timeout
value takes effect immediately.
The
cache timeout update
command controls the periodic updates sent by the permanent type of cache. This
behavior is similar to the active timeout, except that it does not result in the removal of the cache entry from
the cache. By default, this timer value is 1800 seconds (30 minutes).
The cache type normal command specifies the normal cache type. This is the default cache type. The entries
in the cache will be aged out according to the timeout active seconds and timeout inactive seconds settings.
When a cache entry is aged out, it is removed from the cache and exported via any exporters configured for
the monitor associated with the cache.
To return a cache to its default settings, use the default cache flow monitor configuration command.
When a cache becomes full, new flows will not be monitored.
Note
A permanent cache uses update counters rather than delta counters. When a flow is exported, the counters
represent the totals seen for the full lifetime of the flow and not the additional packets and bytes seen since
the last export was sent.
Note
Examples The following example shows how to configure the active timeout for the flow monitor cache:
Device(config)# flow monitor FLOW-MONITOR-1
Device(config-flow-monitor)# cache timeout active 4800
The following example shows how to configure the inactive timer for the flow monitor cache:
Device(config)#
flow monitor FLOW-MONITOR-1
Device(config-flow-monitor)# cache timeout inactive 30
Command Reference, Cisco IOS XE Everest 16.5.1a (Catalyst 3650 Switches)
408
cache