Sample Rate Adjustments

Devices may sample packets to reduce the overall volume of traffic metered for flow accounting.

EF_PROCESSOR_ENRICH_SAMPLERATE_CACHE_SIZE

The collector must adjust the calculation of bytes and packets based on the sampling rate used. Usually devices will inform the collector of the sampling rate either within the flow record itself, or as option data sent periodically by the device. This setting specifies the size of the cache to be used to hold sample rate information learned from option data.

• Default

  • 32768

EF_PROCESSOR_ENRICH_SAMPLERATE_USERDEF_ENABLE

In some cases, a device may not transmit information about the sampling rate for which it is configured. In this case, it is possible to statically define the sampling rate in a file provided to the collector. This setting is used to enable that feature.

• Valid Values

  • true, false
• Default

  • false

EF_PROCESSOR_ENRICH_SAMPLERATE_USERDEF_PATH

If static sample rates are configured for devices in a file, this setting specifies the path from where that file can be loaded.

An example of the format of this file is:

'192.0.2.1': 1024
'192.0.2.2': 512
'192.0.2.0-192.0.2.255': 256
'192.0.2.0/24': 128

# global sample rate
'0.0.0.0/0': 56

• Default

  • /etc/elastiflow/settings/sample_rate.yml

EF_PROCESSOR_ENRICH_SAMPLERATE_USERDEF_OVERRIDE

In some scenarios, it may be desired to use a user-defined sample rate rather than the rate provided by the device. Setting this option to true will check for a user-defined rate even if the device has provided a rate.

• Valid Values

  • true, false
• Default

  • false