Viavi Apex Enterprise G3-APEX-ENT-32T, User Manual

Page: 228 / 380

Understanding GigaStor accelerated analysis
228 GigaStor (23 Feb 2018) — Archive/Non-authoritative version
Understanding GigaStor accelerated analysis
GigaStor accelerated analysis significantly increases the speed that analysis
results are made available in the GigaStor Control Panel. Accelerated analysis first
became available in 17.1.0.0, and starting in 17.2.0.0 it is now always enabled.
Accelerated analysis improves speed by bypassing the data mining process
for packets pre-determined to not match your criteria. In non-accelerated
analysis, every packet in the GigaStor during your selected time slice requires
examination against your analysis query before processing can complete. With
accelerated analysis this is no longer the case. If your analysis query can be
accelerated, your query will be accelerated in-part or in-full without any extra
steps to follow. Your returned results are always as accurate as the “normal”
speed data mine.
Note:
GigaStor accelerated analysis requires version 17.1.0.0 or later. Starting
in 17.2.0.0, it remains enabled at all times.
No special or extra hardware is required for accelerated analysis to operate.
This means both the GigaStor hardware appliances from VIAVI and GigaStor
Software Edition on your own hardware can all use accelerated analysis. Likewise,
the speed increase from accelerated analysis works on active instances and their
passive instances. For example, redirected probe instances to a local Observer will
benefit from accelerated analysis.
Accelerated analysis cannot increase the data mining speed of traffic
that was collected previous to 17.1.0.0. To determine which incoming packets
can be accelerated in future data mines and why, accelerated analysis must
see the packets as they arrive. For example, if you are upgrading to 17.1.0.0
from a previous version, none of your existing GigaStor data can benefit from
accelerated analysis because old versions did not have the feature. Anything new
you collect is a candidate for accelerated analysis.
If any portion of your analysis query cannot be accelerated, log entries are
shown in the Observer log. This means that if no log entries are recorded when
you perform GigaStor analysis, the entire query was sped up with accelerated
analysis. If you see log entries that state accelerated analysis could not be used
for part or all of your data mine, it may lead to clues as to why that happened.
Accelerated analysis attempts to speed up as much of your data extraction as
possible.
Accelerated analysis cannot accelerate any analysis that is specifically
asked to include Expert Information Packets in the results. Asking that
Expert Information Packets be in your GigaStor analysis results causes a condition
where Expert Information Packets are meeting the criteria of your analysis query
every 1-second (the frequency that expert packets are stored) and therefore
negates any performance gains from accelerated analysis because no packets
are bypassed. A warning message of longer extraction times is displayed in the
GigaStor Control Panel if you attempt to include expert packets. Overall, you do
not need to disable the collection of Expert Information Packets for accelerated
analysis to operate correctly—simply do not ask for expert packets in your
analysis results.