UDP Server to Flow Decoder is 90% full. This is normal when the collector is starting. If it persists for hours, it may indicate that you are at your license threshold or your system is under-resourced

ElastiFlow Community
1

Hello

    I just installed a new elastiflow+kibana enviroment but I'm experiencing an issue on performance.

- The environmnet is hosted by enough resources

CONTAINER ID   NAME                          CPU %     MEM USAGE / LIMIT     MEM %     NET I/O          BLOCK I/O       PIDS
adad02bcf2ea   elastiflow_install-kibana-1   3.84%     673.6MiB / 3.863GiB   17.03%    18.2MB / 50MB    479MB / 0B      12
d0c0c6a48da3   elastiflow_install-es01-1     1.49%     11.59GiB / 21.31GiB   54.38%    894MB / 80.8MB   764MB / 2.2GB   159
0ff4fdae8b3e   flow-collector                1.96%     3.061GiB / 31.34GiB   9.77%     0B / 0B          159MB / 811kB   15

top - 12:50:28 up 50 min,  2 users,  load average: 0.28, 0.20, 0.18
Tasks: 192 total,   1 running, 191 sleeping,   0 stopped,   0 zombie
%Cpu(s):  1.1 us,  1.1 sy,  0.0 ni, 97.7 id,  0.0 wa,  0.0 hi,  0.0 si,  0.0 st
MiB Mem :  32095.8 total,  14106.6 free,  16204.2 used,   2390.5 buff/cache
MiB Swap:   3916.0 total,   3916.0 free,      0.0 used.  15891.5 avail Mem

- I activated a basic trial license for 30 days
- I am reciving 30-100 flows per second (but I expect to get more than 1000) 
- I have the titled error while i run a "docker logs -f flow-collector"


Any idea on what is keeping the flow decoder full all the time (without impact the CPU)?

Thanks
Nico
2

I would refer you to this KB article for more information, but my initial guess would be having sufficient CPU allocated?