Flow Interface Statistics Retention
Configuration
Flow interface statistics provide a more detailed view of flow statistics. They are useful
for troubleshooting and investigating recent flow data by providing multiple vantage
points in the network for a given flow. For example, if a flow is observed on multiple
exporters or multiple interfaces of the same exporter, the details are stored in flow
interface statistics.
The Data Store retains data for as long as possible, and the amount of retention time is
determined by your system's ingest rate. Once the Data Store reaches full capacity, it
starts deleting the oldest data automatically.
Flow interface statistics consume storage at a higher rate, potentially reducing the time
you can retain other important data (such as flow statistics), so we limit the flow
interface statistics retention period to seven (7) days maximum by default.
You can use the Stealthwatch REST API to change the flow interface statistics retention
period:
l
to a different number of days, up to 3000, or
l
store the data as long as possible, until the Data Store reaches maximum capacity.
Note the following about Data Store flow interface statistics retention:
l
After you update the data retention settings, you do not need to restart any
Stealthwatch appliance or the Data Store. The settings take effect after a few
minutes.
l
When you change the retention to a longer period, you must wait for the difference
of time to expire before the data being stored corresponds exactly to the retention
settings. Until that time, the data is displayed using the most reduced (i.e.,
coarsest) resolution available. For example, if you change the retention from 3
days to 10 days, then you must now wait 7 days before the data being stored
corresponds exactly to the retention settings.
l
Your data may be deleted sooner than the retention period you select, due to
critical trimming of data according to disk usage. If you choose to store data as
long as possible, when the Data Store reaches full capacity, the system starts
deleting the oldest data.
l
If you do not want to store flow interface statistics, you can access the Admin user
interface for each of your Flow Collectors and choose
Support > Advanced
Settings
. For each Flow Collector, change the “interface_retention_days” entry in
© 2021 Cisco Systems, Inc. and/or its affiliates. All rights reserved.
- 34 -
Flow Interface Statistics Retention Configuration
