07-05-2018 07:53 AM
Is the session is long live ( some applications like nfs,panorama) will start and last till 1 month.
As we have configured log at session end, the log entry will be created once the session is ended.
However we have configured netflow as well.
Netflow is also reporting data to netflow server once the session ended on firewall ( which is 1 month later)
Is this beghavior correct for netflow, I was think it used to report every session information based on interval configured which around 30 min.
We are getting this information on netflow only after session ends. This is affecting for long duration sessions like 1 month.
Is there any parameters to tweak this behavior
07-05-2018 02:40 PM
That is expected behavior.
Before the session ends, the values for things like duration and bytes would not be accurate later if you needed to investigate a particular flow. There wouldn't be an easy way to do delta calculations on the same session since that would require keeping a table of the various active sessions that were still active before, which would probably too much overhead.
You're right in that there is a delta reporting for your configured interval, but that serves to buffer requests and provide cadence. Since the session still didn't end in that interval, the firewall won't use that session until it is actually completed.
07-05-2018 02:40 PM
That is expected behavior.
Before the session ends, the values for things like duration and bytes would not be accurate later if you needed to investigate a particular flow. There wouldn't be an easy way to do delta calculations on the same session since that would require keeping a table of the various active sessions that were still active before, which would probably too much overhead.
You're right in that there is a delta reporting for your configured interval, but that serves to buffer requests and provide cadence. Since the session still didn't end in that interval, the firewall won't use that session until it is actually completed.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
