The Raw Data submodule was an indispensable part of NetFlow troubleshooting, especially for cases where information couldn’t be found in the numerous charts and tables within NetVizura.

The main limitation of the current implementation was the handling of 1- or 5-minute files (depending on the aggregation period), which

When we first adopted Elasticsearch as NetVizura’s primary datastore, we were working with version 6.8. Even back then, Elasticsearch proved to be a powerful and efficient solution for storing diverse data in a single index.

The move to version 7 marked a major step forward. It brought significant performance improvements and introduced syslog support, making our platform even more

NetVizura already has a lot of optimizations regarding data size. For example, NetFlow Analyzer has data aggregations for defined time intervals (g1,g2, and g3 tables for examining data older than 30 days), but sometimes this is not enough. If you are storing data in TB, storing everything in fast NVMe storage doesn't make sense, mainly because of the costs. On the other side, you need to hold

Nowadays, everybody uses compression, deduplication, aggregation, etc., to reduce the pressure on storage and save the company money. In the EventLog world, you cannot delete or in any way modify the older data if you need it for compliance reasons. So, the only things left are compression and hot/warm architecture on the database side. This quick blog will concentrate on compression and

With NetFlow administration and configuration, there are always choices. This blog post will briefly introduce different protocols and their options, as well as real-world examples. Let's dive into two protocols being used today: NetFlow and sFlow.

NetFlow

We won’t discuss history but will instead jump right into the NetFlow protocol's current use and its differences. Currently,