@gertjan said in Heavy traffic monitoring at service or application level:
Looks like you could consider using System > Package Manager > Available Packages > ntopng
ntopng builds 'html' pages to show, so no php that parses huge logs files, and goes "time out" doing so.
ntopng can't see what LAN devices 'consume' per process, of course. It can only see : what IP, what ports used.
I'm not using ntopng myself.
Warning : don't install ntopng an walk away. Check disk space used, process power used, etc. daily.
Thanks for the suggestions, but I see that it's not a ready-made solution:
I need to install a couple of things and configure them, I have skill to follow those procedures, but I really don't like to mess up in BSD, I don't know that extremely well :D , same for the distro on top...
It will weight on my system, I have 16GB of Ram and 8 threads, pretty recent CPU, but I don't think it's enough for what I need, not over a couple of months of HA required to catch these network spikes... Eventually, I should set up another machine for that, but it's gonna be another expense...
I've seen that Redis is a DB in memory, I hope it doesn't run in that way in Pfsense as a package, or that at least I can change the configuration.
Is there anything else you would recommend?
I can search online, but it's better to get advices on my specific requirements.