I think the day starts at the time you created the sensor - was it around 10AM that you set up the 24h sensor? If setting up the 24h and 6h sensors don't catch the culprit within the first few days, you might need to try one of the other netflow tools that save the entire flows, so you can analyse the flows in more detail, after the fact. Sorry, but no, you can't set it to run midnight to midnight. Is there any way to fix that so it runs midnight to midnight? I'm in time zone +10, so I assume it's working to UTC. It looks like they're going to run in "days" that start at 10am. I've created one for 24 hours and one for 6 hours on the original sensor instead of using a new one. I see now - it's the interval setting of the Period setting of the toplist that determines how long it aggregates for.
Why is it aggregating in 15 minute blocks? The first one I set up was left on the default, which turns out to be 60 seconds. I'm a bit confused about how the scanning interval works.
0 kommentar(er)
