How to allocate the reserved RAM
After you have the RAM reserved for Observer, you must allocate it for the probe instances. Here are our basic recommendations for allocating the memory. These are just recommendations and may be changed or modified for your circumstances.
If you are using a GigaStor hardware appliance, read this section, but also be sure to consider the information in Recommendations for the VIAVI capture cards.
How many probe instances will you have on this system? How are you using the probe instance(s)? Are you using it to capture packets or to analyze statistics? After you know how you want to use the probe instance, you can decide how to properly divide the memory amongst the probe instances, and further how you will allocate the memory between the packet capture and statistics queue buffers.
You want to create and use as few probe instances as absolutely necessary. Each probe instance you create divides the memory pool into smaller chunks. The more probe instances you have, the more processing the system must do.
Note: If you have a lot of network traffic, then you may need to allocate at least one gigabyte of RAM to the packet capture buffer, the statistics queue buffer, or both.
For each probe instance determine:
If you want to mostly capture packets, then allocate 90% of the reserved RAM to packet capture and 10% to the statistics queue buffer. At a minimum, you should allocate 12 MB to collect statistics. If you are using a GigaStor, you should allocate the vast majority of the reserved RAM for the active probe instance to packet capture.
If you want to collect statistics or trending data, or use analysis, then allocate 90% (or even 100%) of the reserved RAM to the statistics queue buffer.
If you want to do both, determine which you want to do more of and allocate the memory accordingly.
Recommendations for the VIAVI capture cards
There are capture card requirements and considerations if you are using a GigaStor appliance, as the appliance may have a Gen3 capture card or Gen2 capture card installed.
Here are some special configuration issues to consider when dealing with these capture cards:
For either the Gen3 capture card or Gen2 capture card, you need a minimum of 100 MB allocated to the capture buffer of any probe instance that is bound to the capture card. Allocating less than 100 MB to a probe instance monitoring a VIAVI capture card may cause instability.
If you are using any hardware accelerated probe instance, you must have at least 80 MB for both packet capture and the statistics queue buffer. No packets are captured if either or both are below 80 MB. 80 MB is the minimum, but consider substantially raising this amount. The more RAM that you can allocate to packet capture and statistics, the better your GigaStor probe will perform.
When using multiple probe instances on a GigaStor, ensure that only one probe instance is associated with the capture card. (If you are using virtual adapters to monitor disparate networks, then you may have more than one active instance bound to the capture card.) For performance reasons, all other probe instances should be associated with a different network card.
If you feel a capture card is not performing as expected, ensure that there is only one probe instance bound to it. If there is more than one, verify that the other probe instances are not collecting any statistics. It is possible that the probe instance you are looking at is not collecting any statistics, but one of the other probe instances may be. (This is only an issue if there are multiple probe instances connected to the Gen3 capture card or Gen2 capture card. This does not apply if the other probe instances are connected to a regular network card.)