Network & Infrastructure / Telemetry, Capacity & Incident Analysis
Sampled flow telemetry and estimates for small traffic classes
A security or capacity report treats sampled flow records as an exact count of every connection. Rare flows may be absent, while scaled estimates can carry substantial uncertainty.
Environment and inputs: Network and infrastructure observability; Prometheus examples describe metric semantics rather than a universal exporter schema. Diagnostic/design example; not tested on production equipment.
Collect the evidence
Record sampling method, rate, exporter behavior, active/inactive timeouts and collector loss. Separate sampled packets, exported flows and inferred byte totals in the analysis.
Explain the result
Sampling trades collection cost for uncertainty. A large aggregate may be estimated usefully while a rare event remains unobserved; absence from the sample is not proof of absence from the network.
Plan the fix
Label estimates and limitations explicitly, and use unsampled targeted evidence when exact event presence matters. Select sampling rates from the decision and collection capacity rather than convenience alone.
Check the result and rollback
Compare sampled estimates with a controlled known workload across large and small classes. Revert reporting changes if they present uncertain values as exact or conceal collector drops.