[os-ntopng] Sustained disk writes observed with local RRD timeseries on ZFS

Problem

I observed sustained disk writes while using os-ntopng with local RRD timeseries on an OPNsense VM backed by ZFS/NVMe storage.

I am not sure whether this write volume is expected for this configuration or specific to my setup, so I am reporting the measurements rather than classifying it as a bug.

Evidence

• OPNsense runs as a Proxmox VM on ZFS-backed NVMe storage.
• os-ntopng: 1.3
• ntopng: 6.6.d20260324_2,1
• Five monitored interfaces and approximately 8,103 RRD files
• /var/db/ntopng uses approximately 608 MiB
• ZFS: 128 KiB record size, LZ4 compression
• Proxmox's VM disk-write counter showed approximately 154.7 TB
• Host NVMe SMART lifetime writes were approximately 164.3 TB
• While ntopng was running, VM writes remained around 11–15 MiB/s
• FreeBSD process I/O statistics attributed approximately 97.5% of write operations to ntopng
• After stopping ntopng, two consecutive 10-second measurements dropped to approximately 0.004 MiB/s and 0 MiB/s

The stop/start comparison indicates that local ntopng storage was the main source of writes in this case. Repeated small RRD updates combined with ZFS copy-on-write may be contributing to the physical write volume.

Desired solution

It would be helpful if the plugin UI or documentation warned that local timeseries, especially across multiple interfaces, may cause sustained writes on SSD/ZFS installations. Allowing the ntopng data directory to be configured would also give users more storage options.

Alternatives considered

Monitor fewer interfaces, disable local timeseries, or place ntopng data on separate storage.

Review the os-ntopng plugin UI and documentation, along with how local timeseries data is stored; the issue does not name files or tests. Confirm the sustained-write behavior and establish whether the completed work is a warning, configurable data directory, or documentation update before implementing and verifying the chosen scope.