Concentrator - Aggregation Settings
What exactly is Aggregate Hours?
The description says -
"the hours back to begin aggregation, the milliseconds between rounds of aggregation, and maximum number of sessions per aggregation round."
What does this mean exactly?
For instance, if I have a Concentrator that is non-responsive for a while, and once it is brought online, it'll process only real-time sessions if the value of Aggregate Hours is 0? Or sessions not older than an hour ago, if the value is 1?
Is this what this is meant for? Does the Concentrator see the timestamp value of the session to determine the age in order to proceed with the processing?
- Community Thread
- concentrator group aggregation
- Forum Thread
- RSA NetWitness
- RSA NetWitness Platform
the concentrator will always aggregate all the available sessions from the decoder. Pay attention that the older session that could be aggregate from the concentrator is based on the older meta available on the decoder (meta chache). This is the normal behaviour (Aggregate Hours set to 0). If you change the Aggregate Hours to 1 the concentrator will aggregate only the last hour data in case of stop and restart.
If the value is set to 0, aggregation for each service starts where it last left off, no matter the number of hours behind.