- Other than troubleshooting, how do you make use of your flow data?
Echoing WAN link utilization/identification strategies. I also use it for specific reporting like amount of videoconf traffic, SQL-specific stuff (like being able to show differences in instances, etc.)
- How often do you look at flow data summaries, and in what form (on-demand via HTML form, automated reporting, CLI top-talkers, etc.)?
Probably 3-4 times a day - mostly via web.
- Summaries have the side effect of masking more granular data, i.e. smaller flows that might be interesting. In your view, is this a concern, and if so, how do you work around it?
It can be. I build lots of customized views blown out by proto/IP group - helps a lot to show me the interesting stuff.
- How old does flow data have to get before it's no longer useful? For the sake of SQL, I was only keeping 7 days worth of flow data in NTA, assuming that it would be very unlikely I'd need to go back further than that. That was true most of the time, but there were times I wished I could dig back further.
I like 30 days - just personal preference.