This logic is obsolete, please do not use it for new installations.
Please try our new baseline recommendation logic.
Baseline calculation for FastNetMon can be little bit tricky and we prepared scripts to improve your experience during this process.
First of all, please enable visual traffic export and enable InfluxDB support for FastNetMon. Keep it running for 2-3 days (in best case, for one week to cover all peak hours)
Then, please isntall dependencies for script:
sudo pip3 install influxdb
Please download source code from GitHub:
wget https://raw.githubusercontent.com/FastNetMon/influxdb_baseline/main/influxdb_baseline.py
You need to run it this way:
python3 influxdb_baseline.py
It checks metrics for last 3 days (you can configure it in script) and selects more loaded hosts to use them as threshold. It will need some time (from few minutes to few hours depends on number of hosts). Example output:
Extracted 64000 hosts from InfluxDB Peak values for all your hosts max_packets_outgoing 118860 max_bits_outgoing 1130431688 max_bits_incoming 940248336 max_packets_incoming 217753
According to those values, it should be safe to set threshold_mbps to 1500 and set threshold_pps to 400000 pps. You can add 100-200% to peak value to reduce number of false positives.
We suggest to set these values as thresholds but keep FastNetMon in email notification mode (with BGP Blackhole disable) for 1 week and then you can put it into production if everything works fine.
If you see zeroes in output we can recommend ensuring that you have per host traffic export enabled this way:
sudo fcli set main influxdb_skip_host_counters false sudo fcli commit