FlowSphera 2.1.0 release notes

New: Ingest over time on the Flows page, data retention of your choice, «Last 15 minutes»; fixes collected as build 4 of 2.0.0 (Loss over-count, backups check, Palo Alto setup, sidebar on short windows).

Added

• Data retention of your choice — Settings → General → Data retention: keep flow details for fewer days than the license allows (a small disk), any number from 1 up to the license's days, never more. Shows what the data takes now, about a day, and with the choice. Fewer days delete the older records (and the totals of long periods) within a minute, confirmed with your password; the disk is freed at once (whole old days dropped). An ended license still deletes nothing, as before. Forum request.
• Last 15 minutes in the period selector, with one-minute steps (forum request).
• Ingest over time on the Flows page — under the Inspector: records/s from each device for the chosen period (stacked), the busiest minute of every step, the license limit once traffic comes near it and red bands where records over the limit were not stored. Drag across it to zoom the period; full screen from its button. Built from the per-minute device statistics, so even 30 days open at once (forum request).

Changed

• Flows: no empty space in the top row — choosing a host made the Inspector tall and left a big empty area under the exchange river. The river now grows with the row and shows as many pairs as fit (at least 10, up to 20), and Ingest fills the column when the Inspector is short. On windows under 1,281 px the Inspector and Ingest sit side by side under the river instead of a half-width column.

Fixed

• Palo Alto: downloads showed 0 B — PAN-OS exports only the traffic entering an interface, so with the NetFlow profile on the inside interfaces alone the replies from the Internet never arrive. The setup steps in Settings → Devices → Connect a device → Palo Alto now say to put the profile on the inside AND the Internet-facing interfaces.
• The sidebar cut off «Collector online» and Ingest on short windows (e.g. Edge on Windows with display scaling): the menu now tightens on windows under 1,000 px tall and scrolls by itself when even that is not enough; the collector status always stays in view.
• Backups: a backup showed «damaged» and then «intact» — the full check counted the rows of a restored copy, which ClickHouse merges and trims by age as soon as it is back, so healthy backups were called damaged; a later quick check (files only) then said intact. The full check now counts the rows the backup itself holds (exactly, for new backups), restores it to prove every file and table, and a quick check no longer clears what a full check found. A check that cannot run says so instead of «damaged».
• Backups: «Checking…» could stay until the page was reloaded — the page waited for a result newer than the browser's clock; a quick check finishes within a second, so a computer whose clock is a little ahead never saw it end. The page now waits by the server's clock (also for Back up now and Delete).
• flowsphera backup verify --deep ID takes the id after the options too.
• Loss was too high when a device sends some export packets twice — FlowSphera drops such copies («repeated packets dropped»), but when the device numbered a copy as its next packet (seen on a Palo Alto cluster), the gap that copy left was also counted as lost. Devices → Loss now counts only packets that really did not arrive.