v0.3 Update

The latest release of Psyche (v0.3) builds upon our November 2008 version (v0.2), which was a COMPLETE rewrite from the original code. The latest version contains several bug fixes, a new look-and-feel, and additional functionality. Visit the Download page to access the tarball. Here’s a quick and dirty review of the core elements that have changed since the initial code release last year:

1) New collector (pfcapd) to remove our reliance on nfdump’s nfcapd. Pfcapd, written in C, connects directly to the DB to insert flow records and kicks off data aggregation routines multiple times per second. It is a multi-threaded server, capable of parsing NetFlow v5 records from multiple exporters/routers (i.e., many exporters to one pfcapd process).

2) Updated DB schema to support faster front-end queries. While Psyche still uses Postgres and the same table structure to store raw flows, the rest of the tables are new and designed specifically for the charting and graphing needs of the GUI.

3) New and/or rewritten Postgres stored procedures that perform near real-time aggregation of incoming flows into the tables used by the front-end. Much work has been poured into these routines to optimize their efficiency under heavy load, since pfcapd is able to accept and insert flows at a ridiculously high rate.

4) Total rewrite of the front-end code, which now leverages the TurboGears web development framework. Our new (and much improved) approach is based on Python, and takes advantage of javascript libraries (such as flotr) and other AJAX-y components. We’re constantly looking for ways to improve the Psyche user experience, so please send us your feedback.