How it works
Performance data
How data is collected
- Bitstream performance data collection requires WMI. Performance counters are captured agentlessly and averages are calculated across the polling period, which can be configured to be between 1 minute and 2 hours. The data can then be viewed or exported through the Bitstream Control Panel.
Bitstream settings and default values
- Poll Interval - Poll interval determines how often the remote machine is accessed. We recommend not modifying the default value of 2 hours unless necessary. A shorter poll interval does not change accuracy of data, as all data is captured as deltas, not instantaneous values. Default value - 2 hours.
- Start Time - Defines when we would like to start collection of data. Default value - immediately after enabling collection on specific machine
- End Time - Defines when we would like to stop collection of data. Default value - 31 days after start
- Data retention - Defines how long we want to keep data for. This setting is important to manage space of database. Default value - 60 days
- Active monitoring - Determines whether we want to enable collection automatically on all presently discovered and future discovered devices. Default value - No
Network Traffic Monitoring
How data is collected
Bitstream network traffic monitoring feature requires WMI and SMB. Data capture is done through a dissolvable agent over a preset interval, then data analysis is performed on the appliance. When utilizing the network traffic monitoring feature, we strongly recommend up-sizing the appliance instance to 8 cores, 8 GB RAM in order to allow for additional data processing on the appliance.
Network monitoring settings and default values
Network traffic monitoring feature utilizes the standard poll interval, which means that by adjusting the poll period under Bitstream settings, you are also adjusting the collection period of data for network traffic monitoring.
Performance Impact - Without Network Traffic Monitoring
Summary
We expect to collect from on average 3.5 machines/second with a throughput of approximately 231KB/s during active time of collection. The throughput will depend on number of processes on remote machine as well as the amount of MsSql instances on each machine. Active time of collection is defined by when collection is actively running. On environments under 10k machines Bitstream will be idle for the majority of the time using default settings. Active time of collection (in seconds) can be estimated by taking a number of machines Bitstream targets and dividing by 3.5.
Units of measurement
MB - MegaByte KB - KiloByte
Test Environment
Testing environment is a mixed Windows / Linux environment consisting of 60% Windows and 40% Linux servers.
Polling period was reduced in order to simulate a larger environment where Bitstream has to collect continuously. Please note that in majority of cases Bitstream does NOT operate continuously, instead it operates in bursts of activity.
Bitstream ran for approximately 30 minutes (1835 seconds)
Test Results
Summary
IO Graph:
Total inventories: 6502 (3.54 inventories/second average) Total traffic captured: 422.7MB (231KB/second average) Total packets captured: 2.103M packets (1146 packets/second average, 2036 packets/second peak)
Single Machine Capture
Windows (No MsSQL Server): 128KB/646 packets per inventory* Windows (MsSql Server installed): 204KB/1123 packets per inventory* Linux: 26KB/131 packets per inventory *Windows capture size fluctuates depending on number of MsSql instances installed and number of processes running.
Estimated usage for 1000 machine environments with 2 hour polling interval
1000 Windows devices once every 2 hours (Default settings, 50% SQL server and 50% non-SQL)
- 285 seconds to complete
- 581KB/s (During active window), 82.7MB/hr
- 3095 packets/second during active window (285 seconds)
1000 Windows / Linux once every 2 hours (Default settings, 33.3% SQL Server, 33.3% non-SQL Windows, 33.3% Linux)
- 285 seconds to complete
- 417KB/s (During active window), 59.5MB/hr
- 2216 packets/second during active window (285 seconds)
1000 Windows / Linux once every 2 hours (Default settings, 60% Windows non-SQL, 40% Linux)
- 285 seconds to complete
- 305KB/s (During active window), 43.4MB/hr
- 440 packets/second* during active window (285 seconds)
*Note the number of packets is half of what was measured. This is due to a very varied amount of packets received between different windows machines depending on amount of processes running on the machine.
Location & Manual Removal - Network traffic monitor
The network traffic monitor removes itself automatically after a period of time. In case manual removal is required, stop network traffic collection on Bitstream, kill the "Block64TrafficMonitor.exe" process, and delete the network traffic monitor found under: C:/Windows/Temp/Block64TrafficMonitor.exe
Optionally, mass removal through GPO is possible by following the manual process mentioned above.