Determining the Earliest Data Stored

The amount of time flow information is stored by opFlow (and opFlowSP) is determined by a combination of the opFlow dB collection size, the number of flows sent to the opFlow server, and the average KB/min of data being stored.

You can retrieve the earliest date of data stored for each collection in opFlow using a simple command line script that queries the collection for the first date it contains. You can use the example below to return the date from the lowest summarization (so the most granular; there will be less of these) it will return an epoch date, which you can then convert using date -d.

[root@demo:~]# mongo -u opUserRW -p op42flow42 flows --eval 'db.conversations.find(null,{time:1}).sort({time:1}).limit(1);'
{ "_id" : ObjectId("5a77fbc7b0d1e62e546585f5"), "time" : 1517812543.171 }

[root@demo:~]# date -d @1517812543.171
Mon Feb  5 16:35:43 AEST 2018

NOTE: for opFlowSP simply replace the dB name "flows" above with "flowsp"

Summarization levels are listed in the /usr/local/omk/conf/opCommon.nmis configuration file under opflow_summary_stages. Simply take the key name from the stage and preceed with "summary_", i.e. hourly becomes summary_hourly like so -

[root@demo:~]# mongo -u opUserRW -p op42flow42 flows --eval 'db.summary_hourly.find(null,{time:1}).sort({time:1}).limit(1);'
{ "_id" : ObjectId("59cb0d3fb0d1e634aa7832be"), "time" : 1506474000 }

[root@demo:~]# date -d @1506474000
Wed Sep 27 11:00:00 AEST 2017