Cisco Systems OL-11399-01 manual

CHAPTER 2-1 Cisco NetFlow Collector User Guide OL-11399-01 2 Using the NetFlow Collector User Interface Cisco NetFlo w Collector (NFC), Release 6.0 has a web-based user interface (UI) for conf iguration, control, and reporting. Each collector instance has a web server that the user can start to enable the web-based UI. This chapter includes the fol[...]

2-2 Cisco NetFlow Collector User Guide OL-11399-01 Chapter 2 Using the NetFlow Collector User Interface Customizing the Cisco NetFlow Collector Interface Note The web-based UI only works with the collector located on the same machine. T o access a different instance of Cisco NetFlo w Collector you must start that collector’ s web server and acces[...]

2-3 Cisco NetFlow Collector User Guide OL-11399-01 Chapter 2 Using the NetFlow Collector User Interface Using the Cisco NetFlow Collector User Interface Step 8 When the web conf iguration is complete, the following is displayed: NFC web configuration has been updated. T able 2-1 describes additional settings that can be customized for the Cisco Net[...]

2-4 Cisco NetFlow Collector User Guide OL-11399-01 Chapter 2 Using the NetFlow Collector User Interface Using the Cisco NetFlow Collector User Interface Figur e 2-1 Cisco NetFlow Collect or User Int erf ace Login Window T o log in to Cisco NetFlo w Collector , do the following: Step 1 From the Login window , enter your User ID and Password. Step 2 [...]

2-5 Cisco NetFlow Collector User Guide OL-11399-01 Chapter 2 Using the NetFlow Collector User Interface Configuration Figur e 2-3 NFC UI Navig ation T r ee Configuration From the Conf iguration window you can perform tasks including specify global parameters; def ine f ields, key b uilders, v alue b uilders and aggreg ators; and create f ilters. Fr[...]

2-6 Cisco NetFlow Collector User Guide OL-11399-01 Chapter 2 Using the NetFlow Collector User Interface Configuration Figur e 2-4 NFC Configuration Windo w From this window you can access or conf igure the follo wing: • Aggregators, page 2-7 • Fields, page 2-10 • Ke y Builders, page 2-11 • V alue Builders, page 2-21 • Aggregation Schemes[...]

2-7 Cisco NetFlow Collector User Guide OL-11399-01 Chapter 2 Using the NetFlow Collector User Interface Configuration Aggregators Aggregators def ine ho w the Cisco NetFlo w Collector recei ves NetFlo w data, aggregates or combines the data, and generates output f iles. Click on the Aggregators folder of the NFC UI navigation tree to display a tabl[...]

2-8 Cisco NetFlow Collector User Guide OL-11399-01 Chapter 2 Using the NetFlow Collector User Interface Configuration Figur e 2-6 Add A ggr egator Windo w Fill in the f ields and click Submit to complete the operation. Editing an Aggregator T o modify or remo ve an e xisting aggregator , click Edit for the aggregator which you wish to modify or rem[...]

2-9 Cisco NetFlow Collector User Guide OL-11399-01 Chapter 2 Using the NetFlow Collector User Interface Configuration Figur e 2-7 Modify Aggr egator Windo w T o modify the selected aggre gator , f ill in the f ields and click Modify to complete the operation. T o remov e the selected aggregator , click Remove . Note When a key or v alue builder , f[...]

2-10 Cisco NetFlow Collector User Guide OL-11399-01 Chapter 2 Using the NetFlow Collector User Interface Configuration The top item in the tree is the name of the threshold. Directly beneath this is a top-lev el threshold condition or expression. Add the top-le v el threshold condition or expression by selecting Add condition or Add expression when[...]

2-11 Cisco NetFlow Collector User Guide OL-11399-01 Chapter 2 Using the NetFlow Collector User Interface Configuration Figur e 2-8 Fields Window The NetFlow Export Field windo w , Figure 2-9 , is displayed when adding or modifying a f ield. Fill in the form and click Add or Modify to complete the operation. From the Modify windo w you can also remo[...]

2-12 Cisco NetFlow Collector User Guide OL-11399-01 Chapter 2 Using the NetFlow Collector User Interface Configuration Figur e 2-1 0 Ke y Builders Window All ke y builders ha v e a unique ID and a type. The ID is displayed in the navigation tree and the k ey builder table. The attrib utes shown in the form depend on the type that is selected; dif f[...]

2-13 Cisco NetFlow Collector User Guide OL-11399-01 Chapter 2 Using the NetFlow Collector User Interface Configuration BGP Attribute A BGP Attribute k ey b uilder looks up a BGP attrib ute from the Cisco NetFlo w Collector BGP peer using an address from a f low . The complete AS path is a special case that uses both a source and a destination addre[...]

2-14 Cisco NetFlow Collector User Guide OL-11399-01 Chapter 2 Using the NetFlow Collector User Interface Configuration Bit Field The Bit Field ke y builder obtains a subset of bits from a f ield in a f low . It has the following attrib utes. Boolean A Boolean key builder maps f low v alues to true , false ,o r undef ined . The Boolean key b uilder [...]

2-15 Cisco NetFlow Collector User Guide OL-11399-01 Chapter 2 Using the NetFlow Collector User Interface Configuration Customer Name The Customer Name ke y builder resolv es the customer name from the input interface f ield. It has the follo wing attributes: The Customer Name key b uilder requires conf iguration in the conf ig/vpn.conf f ile. Y ou [...]

2-16 Cisco NetFlow Collector User Guide OL-11399-01 Chapter 2 Using the NetFlow Collector User Interface Configuration Ingress CE The Ingress CE k ey b uilder resolv es the ingress CE from the input interface f ield. It has the following attributes: This ke y builder requires conf iguration in the conf ig/peList.conf f ile. Y ou must include one ro[...]

2-17 Cisco NetFlow Collector User Guide OL-11399-01 Chapter 2 Using the NetFlow Collector User Interface Configuration Integer Range Map An Integer Range Map key b uilder obtains an integer from a f low and maps the v alue to a string. It has the following attrib utes. Mapping information appears in the Integer Ranges list. Each list item contains [...]

2-18 Cisco NetFlow Collector User Guide OL-11399-01 Chapter 2 Using the NetFlow Collector User Interface Configuration IP Address Range Map An IP Address Range Map k ey b uilder obtains an IP address from a f lo w and maps the v alue to a string. It has the following attrib utes. Mapping information appears in the IP Address Ranges list. Each list [...]

2-19 Cisco NetFlow Collector User Guide OL-11399-01 Chapter 2 Using the NetFlow Collector User Interface Configuration Multi-Field Map The Multi-Field Map editor is applet-based and is different than the forms for other k ey b uilder types because of the hierarchical nature of a multi-f ield map. A tree on the left-hand side of the Multi-Field Map [...]

2-20 Cisco NetFlow Collector User Guide OL-11399-01 Chapter 2 Using the NetFlow Collector User Interface Configuration Option Data An Option Data key b uilder obtains one or more key v alues from a f low and performs a look up using this result from an option data cache. The result of the mapping is the corresponding value from option data that was[...]

2-21 Cisco NetFlow Collector User Guide OL-11399-01 Chapter 2 Using the NetFlow Collector User Interface Configuration String A String key b uilder obtains a UTF-8 string value from a f low . It has the following attributes. Subnet Address A Subnet Address key builder obtains an IP address and mask from a f lo w , applies the mask to the address, a[...]

2-22 Cisco NetFlow Collector User Guide OL-11399-01 Chapter 2 Using the NetFlow Collector User Interface Configuration Figur e 2-1 1 V alue Builders Click on Add V alue Builder to bring up an empty form for def ining a new v alue builder . A v alue b uilder is created by specifying its type, associating it with a f ield (sometimes two or more f iel[...]

2-23 Cisco NetFlow Collector User Guide OL-11399-01 Chapter 2 Using the NetFlow Collector User Interface Configuration Active Time The Active T ime v alue b uilder obtains a start time and an end time from f ields in a f low and calculates the difference. It has the follo wing attributes. Directional Sum The Directional Sum v alue builder obtains a[...]

2-24 Cisco NetFlow Collector User Guide OL-11399-01 Chapter 2 Using the NetFlow Collector User Interface Configuration Max Flow Byte Rate The Max Flow Byte Rate v alue b uilder determines the byte rate for each recei ved f lo w and outputs the highest value found for all f lo ws in an aggregation period. This b uilder was referred to as Max Burst R[...]

2-25 Cisco NetFlow Collector User Guide OL-11399-01 Chapter 2 Using the NetFlow Collector User Interface Configuration Sum with Sampling Estimation The Sum with Sampling Estimation value b uilder obtains an inte ger v alue from a f ield in a f low , multiplies by the sampling rate in effect, and adds the estimate to a count. If not used with V9 e x[...]

2-26 Cisco NetFlow Collector User Guide OL-11399-01 Chapter 2 Using the NetFlow Collector User Interface Configuration Figur e 2-14 Modify Aggr egation Scheme Note Removing an aggre gation scheme that is in use by an aggregator can succeed b ut cause an inv alid reference after the collector is restarted. Filters Filters provide a w ay to limit the[...]

2-27 Cisco NetFlow Collector User Guide OL-11399-01 Chapter 2 Using the NetFlow Collector User Interface Configuration The Filter editor is applet-based. A tree on the left hand side of the f ilter editor shows the elements of the f ilter . A form on the right hand side of the f ilter editor contains the attributes for the currently selected item i[...]

2-28 Cisco NetFlow Collector User Guide OL-11399-01 Chapter 2 Using the NetFlow Collector User Interface Configuration Click on the NetFlow Export Sour ce Groups folder of the na vigation tree to display a table of currently def ined source groups, as shown in Figure 2-16 . Click on the appropriate link to modify or remov e a group. Click Add Group[...]

2-29 Cisco NetFlow Collector User Guide OL-11399-01 Chapter 2 Using the NetFlow Collector User Interface Configuration Click on the appropriate link to add or remov e a source de vice or group. Note that groups are obtained from the NetFlo w Export Source Groups page. See the “Creating Access Lists” section on page 4-24 for additional informati[...]

2-30 Cisco NetFlow Collector User Guide OL-11399-01 Chapter 2 Using the NetFlow Collector User Interface Configuration Figur e 2-1 9 Local P eer Set tings Windo w Global The settings in Figure 2-20 affect ho w the Cisco NetFlow Collector works in general. The y are not specif ic to any aggregator , aggregation-scheme, or f ilter . Make any changes [...]

2-31 Cisco NetFlow Collector User Guide OL-11399-01 Chapter 2 Using the NetFlow Collector User Interface Reports In limited cases where the conf iguration is more complex than the web-based UII supports, you will be directed to the Advanced windo w and the XML for the selected component will appear in the text area. Changes can then be made and sub[...]

2-32 Cisco NetFlow Collector User Guide OL-11399-01 Chapter 2 Using the NetFlow Collector User Interface Reports Figur e 2-22 Reports Windo w From this window you can select the follo wing: • Custom Reports, page 2-32 • Scheduled Reports, page 2-37 Custom Reports Custom reports are generated on demand from the NetFlow Collector output f iles on[...]

2-33 Cisco NetFlow Collector User Guide OL-11399-01 Chapter 2 Using the NetFlow Collector User Interface Reports Figur e 2-23 Custom Repor ts Windo w The f ields of the Custom Reports form are described in T able 2-2 .[...]

2-34 Cisco NetFlow Collector User Guide OL-11399-01 Chapter 2 Using the NetFlow Collector User Interface Reports T able 2-2 Custom Repor ts Fields Field V alue Description Start Date A date string in the format of dd MMM yyyy where dd is the day of the month, MMM is the abbre viated name of the month, and yyyy is the four digit year . For e xample,[...]

2-35 Cisco NetFlow Collector User Guide OL-11399-01 Chapter 2 Using the NetFlow Collector User Interface Reports De vices Combine devices , Separate de vices , or Single device . F or Single device the value should be the IP address of the device. Combine devices specif ies that the report will aggregate data from dif ferent exporting de vices into[...]

2-36 Cisco NetFlow Collector User Guide OL-11399-01 Chapter 2 Using the NetFlow Collector User Interface Reports After f illing in the f ields in the Custom Report windo w , you can select one of the following actions: • Generate — Runs the report in a separate browser windo w . A progress bar is shown until the report is displayed. • Generat[...]

2-37 Cisco NetFlow Collector User Guide OL-11399-01 Chapter 2 Using the NetFlow Collector User Interface Reports Figur e 2-24 Report T emplat es List If you select Sav e as T emplate in a custom report form that was created from a template, you can modify the template def inition if you keep the existing template name when prompted for the name. Y [...]

2-38 Cisco NetFlow Collector User Guide OL-11399-01 Chapter 2 Using the NetFlow Collector User Interface Reports Figur e 2-25 Scheduled Repor ts Windo w Clicking Add Scheduled Report brings up the Add Scheduled Report windo w to add a ne w scheduled report. Clicking Edit in any ro w in the list of scheduled reports displays the Modify Scheduled Rep[...]

2-39 Cisco NetFlow Collector User Guide OL-11399-01 Chapter 2 Using the NetFlow Collector User Interface Reports Figur e 2-26 Add Sc heduled Repor t Scheduled Report windows share man y commonalities with the Custom Report windo w , b ut there are a few dif ferences: • There is no Start Date, Start T ime, End Date and End T ime f ields on Schedul[...]

2-40 Cisco NetFlow Collector User Guide OL-11399-01 Chapter 2 Using the NetFlow Collector User Interface Reports T able 2-3 Scheduled Repor t Fields Field V alue Description Scheduled Report ID String containing alphanumeric characters including a hyphen (-) and underscore (_). The ID to identify this type of report. Report Frequency Daily or Hourl[...]

2-41 Cisco NetFlow Collector User Guide OL-11399-01 Chapter 2 Using the NetFlow Collector User Interface Reports Displaying Scheduled Reports Y ou can use the web-based UI to vie w scheduled reports. The IDs of all types of def ined reports display in the Reports navigation tree as subfolders of the Scheduled Reports folder , as shown in Figure 2-2[...]

2-42 Cisco NetFlow Collector User Guide OL-11399-01 Chapter 2 Using the NetFlow Collector User Interface Reports Figur e 2-27 Scheduled Repor ts F older Reporting Features Cisco NetFlow Collector enables you to sort, graph, export, f ilter , and drill do wn on report data from the Report windo w , as shown in Figure 2-22 .[...]

2-43 Cisco NetFlow Collector User Guide OL-11399-01 Chapter 2 Using the NetFlow Collector User Interface Reports Sorting and Graphing Each column of a report supports ascending and descending sorting. Click on the column name to sort the table on that column. V alue columns support creating a bar or pie graph of the v alues in that column. Click on[...]

2-44 Cisco NetFlow Collector User Guide OL-11399-01 Chapter 2 Using the NetFlow Collector User Interface Reports Figur e 2-29 Sample Pie Graph Trending T rending reports can be launched from the Custom Report results windo w , as sho wn in Figure 2-30 . This allo ws you to see how one or more report v alues vary ov er time for the report period. T [...]

2-45 Cisco NetFlow Collector User Guide OL-11399-01 Chapter 2 Using the NetFlow Collector User Interface Status Export and Print The toolbar icons on the top right of the Report window allo w you to export and print report data. Click on the export icon to e xport a report in CSV or PDF format. Click on the print icon to print the report or graph d[...]

2-46 Cisco NetFlow Collector User Guide OL-11399-01 Chapter 2 Using the NetFlow Collector User Interface Status Figur e 2-32 Status Windo w From this window you can select the follo wing: • Control, page 2-46 • Statistics, page 2-46 • Logs, page 2-49 Control Clicking on the Control node of the na vigation tree displays the running status of t[...]

2-47 Cisco NetFlow Collector User Guide OL-11399-01 Chapter 2 Using the NetFlow Collector User Interface Status Figur e 2-34 Health Monitor Statistics Windo w Clicking Refresh updates the statistics displayed in the windo w . Also, the form refreshes automatically e very 30 seconds. The table contains the follo wing f ields; each statistic contains[...]

2-48 Cisco NetFlow Collector User Guide OL-11399-01 Chapter 2 Using the NetFlow Collector User Interface Status Clicking on Refresh updates the statistics sho wn. The table contains the follo wing f ields. Source Statistics Click on the Source Statistics folder of the Statistics na vigation tree to display statistics for the source devices that Cis[...]

2-49 Cisco NetFlow Collector User Guide OL-11399-01 Chapter 2 Using the NetFlow Collector User Interface Status Logs The logs vie wable from the web-based UI are listed under the Logs folder in the navigation tree. Clicking on a specif ic log loads that log f ile into the browser windo w , as sho wn in Figure 2-37 . Figur e 2-37 Viewing Logs in W e[...]

2-50 Cisco NetFlow Collector User Guide OL-11399-01 Chapter 2 Using the NetFlow Collector User Interface Status[...]