flow-rpt2rrd(1)

flow-rpt2rrd(1) General Commands Manual flow-rpt2rrd(1)

2
3
4

NAME

6       flow-rpt2rrd — Convert flow-report CSV output to RRDtool format.
7

SYNOPSIS

9       flow-rpt2rrd  [-nv]   [-d  debug_level]  [-k keys]  [-K keys_file]  [-f
10       fields]  [-p rrd_path]  [-P rrd_postfix]  [-r rrd_storage]
11

DESCRIPTION

13       The flow-rpt2rrd utility processes the CSV output of  flow-report  into
14       RRDtool  format.   The  aggregates for a key are each stored as a DS in
15       RRD filename {rrd_path,"/",key,rrd_postfix,".rrd"}.  By default a DS is
16       created for flows, octets, and packets.  The key must be specified, for
17       example an ip-port report could use smtp,nntp,ssh,telnet  as  the  keys
18       which would create a separate RRD for each key.
19

OPTIONS

21       -d debug_level
22                 Set debug level to debug_level (debugging code)
23
24       -h        Help.
25
26       -k keys|html
27                 Comma  separated  list of key values.  If the report has sym‐
28                 bols then the key must be the symbol, ie smtp  not  25.   The
29                 totals_* lines may be used if they are enabled in the report.
30                 There is no default, keys must be specified with -k or -K.
31
32       -K keys_file
33                 Load keys from keys_file.  See -k.
34
35       -f        Comma separated list of columns to store.  Each  column  maps
36                 to a DS in the RRD.  Defaults to flows,octets,packets
37
38       -n        Enable symbol table lookups.  For example TCP port 25 = smtp.
39                 This will result in RRD file names with the symbolic names if
40                 symbol lookups were not enabled in the report.
41
42       -p rrd_path
43                 Set path to RRD files.  Defaults to ".".
44
45       -P rrd_postfix
46                 Set RRD file name postfix.  Defaults to "".
47
48       -r rrd_storage
49                 Set  RRD  storage  for 5 minute, 30 minute, 2 hour, and 1 day
50                 databases.   List  items  are  :  seperated.    Defaults   to
51                 600:600:600:732.
52
53       -v        Enable verbose output.
54

EXAMPLES

56       The following example shows the combined use of flow-nfilter (inline),
57       flow-report, and flow-rpt2rrd to create an RRD depicting traffic
58       from clmbo-r4 to AS 10796 and 6478 for 2004-11-08.  rrdtool graph is
59       then used to create a .png.
60
61       #!/bin/sh
62
63       cat << EOF>report.cfg
64
65       include-filter nfilter.cfg
66
67       stat-report CLMBO-R4-TO-INTERNET-BY-DESTINATION-AS
68         type destination-as
69         filter CLMBO-R4-INTERNET-OUT
70         scale 100
71         output
72           options +header,+xheader
73           fields -duration
74
75       stat-definition 5min-summaries
76         report CLMBO-R4-TO-INTERNET-BY-DESTINATION-AS
77       EOF
78
79       cat << EOF>nfilter.cfg
80       # ifMIB.ifMIBObjects.ifXTable.ifXEntry.ifName.46 = so-0/0/0.0
81       filter-primitive CLMBO-R4-INTERNET
82         type ifindex
83         permit 46
84
85       # Match on traffic to the Internet
86       filter-definition CLMBO-R4-INTERNET-OUT
87         match output-interface CLMBO-R4-INTERNET
88       EOF
89
90       mkdir rrds
91
92       # 5 minute flow files from flow-capture are here
93       FLOW_DATA=/flows/clmbo-r4/2004-11-08/
94
95       # for each 5 minute flow,aggregate with flow-report then store to RRD
96       for name in $FLOW_DATA/*; do
97         echo working...$name
98         flow-report -s report.cfg -S5min-summaries < $name | flow-rpt2rrd -k10796,6478  -p rrds
99       done
100
101       # first flow - 0:1:23 11/8/2004
102       START=1099890083
103       # last flow - 0:1:25 11/9/2004
104       END=1099976485
105
106       rrdtool graph CLMBO-R4-TO-INTERNET.png --start $START --end $END         --vertical-label "Bits/Second" --title="CLMBO-R4 TO INTERNET BY AS"         DEF:AS10796in=rrds/10796.rrd:octets:AVERAGE         DEF:AS6478in=rrds/6478.rrd:octets:AVERAGE         CDEF:b_AS10796in=AS10796in,8,*         CDEF:b_AS6478in=AS6478in,8,*         LINE1:b_AS10796in#FF0000:AS10796-in         LINE1:b_AS6478in#555555:AS6478-in .fi
107

BUGS

109       Hard  coded  to expect 5 minute flow file intervals.  Does not properly
110       parse flow-report time-series output.
111

AUTHOR

113       Mark Fullmer maf@splintered.net
114