I would like to explore if it is possible to increase our retention on our packet decoders.
Under the explore view on the packet decoder there is a setting:
"packet compression" which by default is set to none, but can be set to gzip.
The packet compression level is currently set to zero which is the best mix between compression and speed.
I looked at one of the packet decoder packet database files with the command:
strings packet-000423232.nwpdb
And I can see that there is a lot of clear text data written in text which suggests that compression might not be being used.
Is there a document or any information on how to increase packet retention by tuning these settings?
I found the core database tuning guide, but is it just a case of try it and see?
I am not aware of any official documentation of the feature, but I use the compression setting quite a lot. I haven't found a statistically significant difference between the settings 5 (average), 9 (max), and 0 ("best mix"), but given given the principles behind why you would turn on compression in the first place (namely, that you'll rarely be clicking through so many raw packets that decompressing them will allow down an investigation) I don't see a problem with just selecting 9. I'm actually collecting some stats on compression right now with a customer and if I can remember to come back here and Pat then I will.