Question for the sampling rate

[luocooong]

Hi, thank you for your great open source. Then I found a question unable to get the answer on docs, like the following list:

1. How do I set the sampling rate to 100% (or 1-in-N)? because I used the snippet(sampling = 1) and it's not working.
2. How do I understand the log infos of sampling? "SamplingRate":1000,"SamplePool":9000

There are full settings:

agent.cidr = 192.168.0.0/16
polling = 60
sampling = 1
collector { ip=127.0.0.1 udpport=6343 }
pcap { speed = 1- }
tcp { }

[sflow]

Assuming you are using version 2.0.48 or later, Interfaces with non-zero ifSpeed pick up their sampling rate settings in this order of precedence:

1. sampling.SPEED = N
2. sampling.bpsratio = R
3. sampling = N

And the sampling.bpsratio has a default value of 1000000. Sp your config is computing the sampling rate as ifSpeed/1000000. This works out to 1:1000 for a 1Gbps interface and 1:10000 for a 10Gbps interface.

I hope you understand that 1:1 sampling is not recommended because there is no aggregation in sFlow: every packet header will be exported. But perhaps you are just doing this for testing purposes?

To force 1:1 sampling you have two choices. You can either set the sampling.SPEED settings like this:

sampling.1G=1 sampling.10G=1 ...

or you can turn off the sampling.bpsratio like this so that it falls back on sampling=N:

sampling.bpsratio=0 sampling=1

Sorry this is not well documented yet!

[luocooong]

@sflow Hi, It finally worked(set the samping.SPEED = 1), 1:1 ratio only applies to the test, thank you. And then, there are some questions for the project:

1. What is the technical principle of hsflow project capture the sflow protocol? Is there an performance impact on the host?
2. How do I understand the data fields of the sflow (special reference to the sflow protocol)?
3. Is it possible to provide an armv8-based version in the next release?

[sflow]

(1) sFlow is designed to run continuously on all servers and network switches. The sampling rate can be adjusted to make sure that there is no performance impact. The goal is to provide essential visibility even when (especially when) the system is under pressure. (2) For a low-level example of decoding the XDR-formatted output see the sflowtool project. The spec is held at https://sflow.org. For examples and discussion see https://blog.sflow.com and GoogleGroups:sFlow. To understand what is possible on the analytics side you might experiment with sFlow-RT. (3) I believe the current hsflowd sources can be compiled on ARM? Please raise an issue if that doesn't work.

[luocooong]

@sflow Thank you for that reply.