Stealthwatch Capacity planning

What are the parameters other than CPU, Memory and Storage that should be monitored on Stealthwatch in order to do capacity planning effectively. Following are been deployed int the production environment

FlowCollector for NetFlow 4000

FlowReplicator 2000 - UDP Director

SMC- VM

FlowSensor 1000

Great question, @Kumar Mittal

At the heart of the system the FlowCollector 4000 is rated to consume a 120,000 flows/sec consistently.  You can see that consumption on the Flow Collector Dashboard in the Desktop Client.  You already mentioned storage but look at the appliance interface on the FlowCollector under the Database Statistics view you will see how much is being utilized and how many days of retention you have.

The UDP Director appliance UI will show you the pps in/out and you'll want to be mindful of, the link utilization of the production interface because that's generally the first bottleneck folks encounter on that device.

On the FlowSensor, monitor the link utilization.  You can use the Interface Status view of that exporter. You don't want to overrun the bandwidth of the input link or you'll miss traffic.

On the SMC you'll have some slowness if you're letting the whole SOC and NOC teams bang on it while running heavy reports and managing two dozen FlowCollectors during peak traffic times.  Fortunately, the stuff you need to monitor there is already in the Desktop Client, just double-click on the SMC in the enterprise tree on the left.

Hope that helps,

--jg