Collect cflowd Records with an Accounting Group

To perform discard accounting on specified traffic, you can collect cflowd records with the accounting statement at the [edit forwarding-options] hierarchy level. Like sampling, your topology must be simple (for example, one input interface and one export interface).

Again, you can collect cflowd records by specifying input and output interfaces. You can configure the input interface to perform discard accounting by applying a firewall filter that contains the then discard accounting statement. This match condition directs the filtered traffic to be converted into cflowd records and exported for analysis by the monitoring services or adaptive services interface. The original packets are then sent to the discard process. For the output, remember to specify the IP address and port of your cflowd server and the services interface you plan to use for processing cflowd records.

You must configure a source address, but the engine-id and engine-type output interface statements are added automatically. You can override these values manually to track different flows with a single cflowd collector. SNMP input and output interface index information is captured in cflowd records by default when you configure discard accounting.

[edit]

forwarding-options {

    accounting counter1 {

        output {

            flow-inactive-timeout 65;

            flow-active-timeout 65;

            cflowd 10.60.2.1 {

                port 2055;

                version 8;

                aggregation {

                    protocol-port;

                    source-destination-prefix;

                }

            }

            interface sp-2/0/0 {

                engine-id 1;

                engine-type 11;

                source-address 10.60.2.2;

            }

        }

    }

}