You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
It looks like work still needs to be done on nfcapd side to actually store zstd.
Once that is added, then perhaps might make a nfsen a little more future proof by having a $Comparg to be just inserted as the user sets (and set to -y if $ZIPcollected is set to 1, to maintain backwards support) so that way people that actually want to tweak things could just do -z=<x> without having to hack the source :)
The text was updated successfully, but these errors were encountered:
The config allows now more flexible settings for the compression:
The nfsen-dist.conf comments:
# Compress flows in profiles. Set to any value accepted by nfcapd/nfdump
# e.g. "-z=lz4", "-z=zstd:5"
# the value 1 is accepted for compatibility and set to "-z=lz4"
# the value "" means no compression
$ZIPprofiles = "-z=lz4";
With the recent changes for nfdump 1.7.2 to unify compression settings -z it looks like nfsen needs some updates to be able to really use that.
My goal is to want to start using zstd by default for compression instead of lz4.
Right now in nfsen conf there is
$ZIPcollected
which either 0 or 1.If 1, then
-y
is added to argument to start collector (which for lz4).https://github.com/phaag/nfsen/blob/main/libexec/NfSenRC.pm#L98
It looks like work still needs to be done on nfcapd side to actually store zstd.
Once that is added, then perhaps might make a nfsen a little more future proof by having a
$Comparg
to be just inserted as the user sets (and set to -y if $ZIPcollected is set to 1, to maintain backwards support) so that way people that actually want to tweak things could just do-z=<x>
without having to hack the source :)The text was updated successfully, but these errors were encountered: