NAM Probe performance tuning

When monitoring a high volume of traffic with a low number of users, the NAM Probe capacity depends mainly on the volume of traffic measured. Depending on the traffic profile, certain configuration settings may have a large effect on NAM Probe performance because they can reduce the volume and complexity of the analyzed traffic at the NAM Probe or on the report server.

For large volumes of traffic with low numbers of users, the main bottleneck is CPU speed. Insufficient processing power means the NAM Probe cannot keep up with the traffic received on the network interface card and starts to drop packets. These limits are defined for the whole NAM Probe (the total for all interfaces).

If CPU speed is the limiting factor, minimize the traffic as much as possible and as early as possible. You should also re-examine NAM Probe configuration settings.

The following steps summarize the process of resolving NAM Probe performance issues. Some steps may not be essential in all cases.

  1. Verify the compatibility of the NIC.
  2. Switch to a custom NIC driver.
  3. Upgrade to a 64-bit NAM Probe.
  4. Assess the amount of traffic volume that exceeds the acceptable limits and use this information when defining your traffic filters later.
  5. Switch to HTTP mode if the HTTP legacy mode is used in the NAM Probe Global HTTP options.
  6. If possible, filter some of the traffic before it enters the NAM Probe.
    For example, use the VACL, port mirroring filtering such as the SPAN port filtering feature of Cisco switches, or other filtering capabilities offered by network packet brokers such as Gigamon.
  7. Configure the NAM Probe to use user-defined software services only, provided that this agrees with your monitoring requirements.
    The effectiveness of such filtering and its impact on performance is heavily dependent on the traffic profile and the CPU power required to analyze the traffic that is not filtered out. The NAM Probe can filter out more traffic when monitoring more analysis-hungry protocols such as HTTP, but less traffic for generic TCP traffic.
  8. Optimize your NAM Probe configuration settings.
    For more information, see Configuring NAM Probe scalability options.
  9. Consider using NAM Probes in a load-sharing configuration by duplicating the data feed or using intelligent switching. You can configure two or more NAM Probes to receive the same traffic with each analyzing only part of it.