Performance

Long periods (1.17.0). A synthetic busy network sending 5,000 records/s (the most Community stores) for 12 hours — 216 million records, 9.7 GiB on disk — and pages asked for the day that holds them, in a VM with 6 vCPUs of an Intel Core i5-1145G7 and 12 GB of RAM (ClickHouse ~6 GiB), measured on 2026-10-25 by FlowSphera's regression lab: the same data, first on 1.16.2, then upgraded to 1.17.0 and its new summary tables filled; 656 requests (every page × period × filter), nothing cached. A page sends its requests at once, so a page takes as long as its slowest one:

All 656 requests together: 2,897 s → 682 s; rows read by ClickHouse: 158 billion → 42 billion. Before the release every summary table was compared with the records, row by row (the same keys and sums): identical. What still reads the records for a day: a chosen host's ports, QoS and geolocation, the device map under a port filter (the slowest request left: 27 s), and live windows of a few minutes.

Measured on 2026-10-08 with FlowSphera 1.3.3 in a VM with 4 vCPUs of an Intel Core i5-1145G7 (a laptop-class CPU) and 4 GB of RAM; ClickHouse runs in the same VM with the 2 GiB the installer gives it on such a machine.

Receiving. Real FortiGate NetFlow v9 packets (about 10 records each) offered at a steady rate for 2 minutes; counted is what was stored once the queues had drained:

Short bursts above these rates are absorbed by the queues (one worker took 62,500 records/s for 15 s without loss). Whatever does not fit is dropped at the worker queues, counted and shown in Settings → Devices — never silently. One worker decodes and enriches about 74,000 records per second on one core (the decoder is compiled); the rest of the CPU goes to the receiver and to ClickHouse's inserts and merges. For scale: a small office firewall exports a few records per second, a busy 1 Gbit/s internet edge typically a few thousand. FlowSphera Community stores up to 5,000 records/s (see Editions).

Pages. A synthetic busy network of 40 million records a day (about 460 records/s on average; 5,000 inside hosts, 200,000 outside addresses, 12 million host–peer pairs) in the same VM. Overview page, all panels loading at once, first load (nothing cached):

Most of the 24 hours goes to Top conversations (pairs of an inside host and an outside address are read from the flow records); the other panels read the 5-minute and hourly totals. Periods of several days at this scale have not been measured yet. Answers for 6 hours or more are kept on the server for 60 s, so reloads and other users with the same period get them at once. On a small office network (about 4 records/s, 330,000 records a day; real data) every Overview request for 24 hours or 7 days is answered in under 0.1 s.

A busy network (1.8.1). 2,400 records/s — a day of about 207 million records (7.3 GiB) plus the live stream — in a VM with 4 vCPUs and 8 GB of RAM (ClickHouse 3.9 GiB). Requests the pages send for 24 hours, nothing cached: