log udp flows to file
move dept_data lookup into separate class/file
wrap flow procesing in a class and rotate files daily
fork process to lzma on file rotation
Sample per log source
change sample rate to 1/100