Cisco Netflow CPU Utilisation Question

Hello Experts,

Can someone please tell me if adding the following Netflow Record and corresponding Monitor will overwhelm the cpu on our router?

flow record FlowRecord1
match ipv4 protocol
match ipv4 tos
match ipv4 source address
match ipv4 destination address
match transport source-port
match transport destination-port
match flow direction
match interface input
match interface output
collect flow direction
collect transport tcp flags
collect transport tcp source-port
collect transport tcp destination-port
collect routing source as
collect routing destination as
collect routing source as peer
collect routing destination as peer
collect routing next-hop address ipv4
collect routing destination as
collect ipv4 source prefix
collect ipv4 id
collect ipv4 protocol
collect ipv4 tos
collect ipv4 routing source as
collect ipv4 source mask
collect ipv4 destination prefix
collect ipv4 destination mask
collect interface input
collect interface output
collect counter bytes
collect counter packets
collect application name
collect timestamp sys-uptime first
collect timestamp sys-uptime last
collect timestamp absolute first
collect timestamp absolute last

flow monitor FlowMonitor1
 cache timeout active 86520
 cache entries 32768
 record FlowRecord1


Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Hi Carlton.

This all depends on a few things like, network usage / speed of link to, the router, and processor engine installed.
Unless you paste the device hardware specs, where you plan to do this it will not be possible to forecast. Also to be taken into account is: the present cpu/memory utilization. Then only some calculated guess can be made, although it might vary hugely with practical implementation.

Best way would be to go phase by phase while keeping a tab on the resource utilization. I do not think any scientific benchmark exist for this. You just need to keep checking the CPU utilization once you enable step by step.

If your present CPU utilization is <40%, roughly the guess would be to go for few at a time and gradually keep adding the match-collect criterion till it reaches 70%. You should stop at 80% cpu max.


Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
cpatte7372Author Commented:
Cheers mate.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today

From novice to tech pro — start learning today.