Limiting ntopng disk usage
-
Curious how others are handling this.
I've got a 8192 MB RAM Disk for /var to prevent a ton of writes to my drive, which feels pretty generous, almost excessive.
I've got notpng configured as such:
Regardless every couple of days I'm managing to overflow /var, and thus pfsense goes down hard.
I really hate the idea of setting up influxdb in a VM on another box for this, is it possible to just segregate ntopng to something less critical than /var/? Ideally any package would not be writing to a shared RAM disk which could take down the entire system.
-
@digitalgimpus ntopng writes a ton of data to disk. There is no way around this. To lessen it a bit, you could turn off the host time series data, and the interface data. But there will still be a ton of writes. Even if you use InfluxDB off host for the traffic data, there will still be a lot of local writes via Redis. In short, if you care about disk writes, do not run ntopng.
FWIW, I recommend ntopng be used as a diagnostic resource when you have issues. I do not recommend ntopng as something you continuously run.
-
@dennypage Noted, and thanks.
-
@dennypage Hi, do you know if there is a way to purge old data automated? I would want to run this permanent as my system is more then capable to keep up. The only thing that is a problem is running out of diskspace over a long period. I just have the need to view things of the last couple of days i do not care if things have happened weeks ago.
-
@Leon-Straathof Data retention settings are handled inside of ntopng. Documentation here. Pay attention to the RRD note.
Also, if you've turned on some of the slice and dice time series information (is off by default), I'd suggest turning them back off. These balloon the storage requirements and are of little actual use.
