You should increase the client minimum report interval to something like 90 seconds or more:
_BESClient_Report_MinimumInterval
You should increase the analysis report interval to something like 300 seconds or more:
_BESClient_Report_MinimumAnalysisInterval
I would suggest bumping up these numbers from the defaults slowly and measure the change.
You can also have the relays in the stores hold onto reports for longer, a larger size, and more in number so that they send the reports up the chain in larger batches. The defaults are pretty fast/small/chatty, which is fine when it isn’t going over a WAN.
Client polling is not the issue as @strawgate recommends because that should only effect traffic between the clients themselves and their direct parent relay. It should not cause much more traffic from the relay in the stores and the next level up relay in the NOC. It should mostly affect the traffic from the relay in the stores to the clients in the stores.
I’m not certain about the traffic from the client heartbeat that @strawgate mentions and how that is passed along from the relays, if at all. In either case, increasing the heartbeat to 45 minutes to an hour is not a bad idea, but I don’t think that will have nearly the impact that the minimum report interval would since that is something like 30 seconds by default, while the heartbeat is something like 20minutes by default.
See this: https://gist.github.com/jgstew/51a99ab4b5997efa0318
Also: http://bigfix.me/analysis/details/2994765
Related: