Configuring Flow Collection
Configuring Destination FTP Servers for Flow Records
Flow collection destinations are where the compressed ASCII
data files are sent after the cflowd records are collected and processed.
To specify the destination FTP server, include the destinations statement at the [edit services flow-collector] hierarchy
level. You can specify up to two FTP server destinations and include
the password for each configured server. If two FTP servers are configured,
the first server in the configuration is the primary server and the
second is a backup server.
To configure a destination for flow collection files, include
the destinations statement at the [edit services flow-collector] hierarchy level:
[edit services flow-collector] destinations { ftp:url { password "password"; } }
To specify the destination FTP server, include the ftp:url statement. The value url is the FTP server address for the primary flow collection
destination and can include macros.
When you include macros in the ftp:url statement, a directory can be created only for a single level.
For example, the path ftp://10.2.2.2/%m/%Y expands to ftp://10.2.2.2/01/2005, and the software attempts to create
the directory 01/2005 on the destination FTP server. If
the 01/ directory already exists on the destination FTP
server, the software creates the /2005/ directory one level down. If the 01/ directory does not exist on
the destination FTP server, the software cannot create the /2005/ directory, and the FTP server destination
fails. For more information about macros, see ftp.
To specify the FTP server password, include the password
“password” statement. The password
must be enclosed in quotation marks. You can specify up to two destination
FTP servers. The first destination specified is considered the primary
destination.
Configuring a Packet Analyzer
You can specify values for the IP address and identifier of a packet analyzer to which the flow collector interface sends traffic for analysis. The values you specify here override any default values configured elsewhere.
To configure an IP address and identifier for the packet analyzer,
include the analyzer-address and analyzer-id statements at the [edit services flow-collector] hierarchy
level:
[edit services flow-collector] analyzer-address address; analyzer-id name;
Configuring File Formats
You configure data file formats, name formats, and transfer characteristics for the flow collection files. File records are sent to the destination FTP server when the timer expires or when a preset number of records are received, whichever comes first.
To configure the flow collection file format, include the file-specification statement at the [edit services flow-collector] hierarchy level:
[edit services flow-collector] file-specification { variant variant-number { data-format format; name-format format; transfer { record-level number; timeout seconds; } } }
To set the data file format, include the data-format statement. To set the file name format, include the name-format statement. To set the export timer and file size thresholds, include
the transfer statement and specify values for the timeout and record-level options.
For example, you can specify the name format as follows:
[edit services flow-collector file-specification variant variant-number] name-format "cFlowd-py69Ni69-0-%D_%T-%I_%N.bcp.bi.gz";
In this example, cFlowd-py69Ni69-0 is the static
portion used verbatim, %D is the date in YYYYMMDD format, %T is the time in HHMMSS format, %I is the value
of ifAlias, %N is the generation number, and bcp.bi.gz is a user-configured string. A number of macros are
supported for expressing the date and time information in different
ways; for a complete list, see the summary section for name-format.
Configuring Interface Mappings
You can match an input interface with a flow collector interface and apply the preset file specifications to the input interface.
To configure an interface mapping, include the interface-map statement at the [edit services flow-collector] hierarchy
level:
[edit services flow-collector] interface-map { collector interface-name; file-specification variant-number; interface-name { collector interface-name; file-specification variant-number; } }
To configure the default flow collector and file specifications
for all input interfaces, include the file-specification and collector statements at the [edit services flow-collector
interface-map] hierarchy level. To override the default settings
and apply flow collector and file specifications to a specific input
interface, include the file-specification and collector statements at the [edit services flow-collector interface-map interface-name] hierarchy level.
Configuring Transfer Logs
You can configure the filename, export interval, maximum size, and destination FTP server for log files containing the transfer activity history for a flow collector interface.
To configure a transfer log, include the transfer-log-archive statement at the [edit services flow-collector] hierarchy
level:
[edit services flow-collector] transfer-log-archive { archive-sites { ftp:url { password "password"; username username; } } filename-prefix prefix; maximum-age minutes; }
To configure the destination for archiving files, include the archive-sites statement. Specify the filename as follows:
[edit services flow-collector transfer-log] filename "cFlowd-py69Ni69-0-%D_%T";
where cFlowd-py69Ni69-0 is the static portion used
verbatim, %D is the date in YYYYMMDD format, and %T is the time in HHMMSS format.
You can optionally include the following statements:
filename-prefix—Sets a standard prefix for all the logged files.maximum-age—Specifies the duration a file remains on the server. The range is 1 through 360 minutes.
Configuring Retry Attempts
You can specify values for situations in which the flow collector interface needs more than one attempt to transfer log files to the FTP server:
Maximum number of retry attempts
Amount of time the flow collector interface waits between successive retries
To configure retry settings, include the retry and retry-delay statements at the [edit services flow-collector] hierarchy level:
retry number; retry-delay seconds;
The retry value can be from 0 through 10. The retry-delay value can be from 0 through 60 seconds.