Windows senagent network traffic
This page was last modified 02:31, 10 May 2006.From Documentation
(Difference between revisions)
| Revision as of 02:20, 10 May 2006 Daniels (Talk | contribs) ← Previous diff |
Current revision Daniels (Talk | contribs) (→Results) |
||
| Line 4: | Line 4: | ||
| == Senagent Network Traffic == | == Senagent Network Traffic == | ||
| + | Tests were carried out to discover how much network traffic was generated by running Windows monitoring using the senagent executable file. | ||
| - | After writing out the instructions for monitoring ntcpio.exe and COSserver.exe yesterday, I decided to monitor how much data senagent.exe pumps out and across the network. You have always been concerned on the impact senagent has on the network. | + | The test environment was a Linux machine for the Event Host, and a Windows2000 machine for the windows host. The windows machine was the only windows machine on the network, in order to maintain good data integrity. |
| - | Well, now I know. My test environment involved a Linux host (for the host monitor and event manager) and a Windows 2000 host (running senagent.exe). As there were no other Windows hosts on the network, Windows chatter would be minimal or non-existent. I left the test running all last night. | + | The test was left to run for 12 hours. |
| - | Results: | + | === Results === |
| + | *Senagent.exe is recorded as consistently pumping out close to 400 bytes of data every 2nd poll - that is, a peak of 400 bytes every 3 minutes approx. The intermediate poll shows zero or very close to zero bytes. I don't actually understand why there is this behaviour, but that is what the recorded data per poll shows. | ||
| + | *Data written from the Windows network card across the network shows a little different. Over the test period, data written remained constant (flat line) at 0.1Kb/sec - no peaks and no troughs. That is 100 bytes/sec - not much at all. | ||
| - | * Senagent.exe is recorded as consistently pumping out close to 400 bytes of data every 2nd poll - that is, a peak of 400 bytes every 3 minutes approx. The intermediate poll shows zero or very close to zero bytes. I don't actually understand why there is this behaviour, but that is what the recorded data per poll shows. | + | The above results yield the following information |
| - | * Data written from the Windows network card across the network shows a little different. Over the test period, data written remained constant (flat line) at 0.1Kb/sec - no peaks and no troughs. That is 100 bytes/sec - not much at all. | + | *Up to 100 000 Windows hosts can be monitored on a single network segment before saturating a 100M network |
| + | **remember 100M network is capable of 10Mb/sec throughput. | ||
| + | *Conversely, given a more realistic 100 Windows hosts being monitored, the senagent information would account for only 10Kb/sec, or 0.1% of the capable network throughput on a 100M network | ||
| - | * See attached graphs. | + | In short any concerns regarding the impact on the network by senagent.exe are unfounded. The impact is negligable. |
| - | Since it is the network impact we are concerned about, the above results mean: | + | ---- |
| - | We can have up to 100 000 Windows hosts on a single network segment before we saturate a 100M network - remember 100M network is capable of 10Mb/sec throughput. | + | |
| - | Or given a more realistic number of say 100 Windows hosts being monitored, it would account for only 10Kb/sec - or 0.1% of the capable network throughput on a 100M network. | + | |
| - | In short any concerns regarding the impact on the network by senagent.exe are unfounded. The impact is neglegable. | + | [[Image:Senagent_throughtput.JPG]] |
Current revision
[edit]
Technical Note
Please note that this article recreates Technical Note 214, originally posted May 10, 2006.
[edit]
Senagent Network Traffic
Tests were carried out to discover how much network traffic was generated by running Windows monitoring using the senagent executable file.
The test environment was a Linux machine for the Event Host, and a Windows2000 machine for the windows host. The windows machine was the only windows machine on the network, in order to maintain good data integrity.
The test was left to run for 12 hours.
[edit]
Results
- Senagent.exe is recorded as consistently pumping out close to 400 bytes of data every 2nd poll - that is, a peak of 400 bytes every 3 minutes approx. The intermediate poll shows zero or very close to zero bytes. I don't actually understand why there is this behaviour, but that is what the recorded data per poll shows.
- Data written from the Windows network card across the network shows a little different. Over the test period, data written remained constant (flat line) at 0.1Kb/sec - no peaks and no troughs. That is 100 bytes/sec - not much at all.
The above results yield the following information
- Up to 100 000 Windows hosts can be monitored on a single network segment before saturating a 100M network
- remember 100M network is capable of 10Mb/sec throughput.
- Conversely, given a more realistic 100 Windows hosts being monitored, the senagent information would account for only 10Kb/sec, or 0.1% of the capable network throughput on a 100M network
In short any concerns regarding the impact on the network by senagent.exe are unfounded. The impact is negligable.
