[flow-tools] [maf@eng.oar.net: Re: [Cflowd] cfdcollect rotate time]

[Mark Fullmer]

----- Forwarded message from Mark Fullmer <maf@eng.oar.net> -----

Date: Wed, 22 Jan 2003 12:58:51 -0500
From: Mark Fullmer <maf@eng.oar.net>
To: Alexis <alexis@attla.net.ar>
Subject: Re: [Cflowd] cfdcollect rotate time
X-Mailer: Mutt 1.0i

Look at flow-nfilter and flow-report.

There are many examples on the mailing list...

mark

On Fri, Jan 17, 2003 at 10:41:50PM -0300, Alexis wrote:
> Mark, could you give me a hand with an issue please?
> If you really can, here's my issue.
> Ive been reading all the man's and testing and did so many things that i
> need. But i still need one to finish and i have no time.
> 
> Here's the scenario.
> 
> I have 2 7513(Cisco Routers) configured with
> 
> ip flow-export source Loopback0
> ip flow-export version 5
> ip flow-aggregation cache prefix
>  cache timeout inactive 200
>  cache timeout active 4
>  export destination 200.61.32.233 2055
>  enabled
> 
> Configured (200.61.32.233 is the host running flow-tools)
> 
> Those 7500's are the distribution layer of our IP Backbone (for
> international traffic). And a few interfaces, those who interconnect the
> core routers with the distribution layer, configured with ip route-cache
> flow.
> 
> Until here, all is pretty, all is nice.
> 
> In the PC i have running
> 
> /usr/local/netflow/bin/flow-capture -V 8.5 -n 144 -N -1 -E5G -w /exports
> 172.16.254.61/0/2055
> 
> it works great, have no problems.
> 
> The problem that cflowd+cfdcollect causes me, is related to the file that
> cfdcollect generate.... the 7500's have a strong traffic (aprox 1G each) and
> the file becomes really HUGE , and when i run for example artsnets to fetch
> some info, this command take a long long long long time.
> 
> Ok, now, i need to graph incoming and outgoing traffic for a prefix /27 from
> one of our customers (this prefix was previously distributed via OSPF inside
> our AS, so all the "border" routers know this prefix). With national
> traffic, cflowd and cfdcollect works fine, but it doesnt even exists with
> the traffic of the 7500.
> 
> so. returning to the issue, the PC is capturing all the flows that the
> 7500's are sending to it. My question is how can i fetch every 5 minutes the
> traffic with::::::
> 
> source: A.B.C.D/27
> destination: A.B.C.D/27
> 
> with traffic i mean, or the total bytes that have passed trough the
> interfaces (then rrd makes all the numbers) , or even better, the k/s for
> these /27
> 
> 
> Thank you very much.
> 
> I do not need all the schema or anything even like it, if you can only show
> me the way, its enough to me.
> 
> Thanks Again
> 
> 
> 
> ----- Original Message -----
> From: "Mark Fullmer" <maf@eng.oar.net>
> To: "Alexis" <alexis@attla.net.ar>
> Sent: Wednesday, January 15, 2003 12:25 PM
> Subject: Re: [Cflowd] cfdcollect rotate time
> 
> 
> > Look at flow-tools http://www.splintered.net/sw/flow-tools
> >
> > The flow-capture program allows configuration of the rotation interval.
> >
> > mark
> >
> > On Wed, Jan 15, 2003 at 11:01:38AM -0300, Alexis wrote:
> > > Hi all.
> > > Last night i sent a mail, but im not shure if it really left my computer
> at
> > > home, because i cant see it in the sent items.
> > > So, if i sending the same mail twice, please accept my apologizes.
> > >
> > > The question related to cfdcollector is if i can change the time that
> > > cfdcollect uses to rotate the files where it stores the consolidated
> data
> > > (arts files), that is 24 hours.
> > >
> > > The reason why im asking this is the following... Im collecting data
> from
> > > 8 -lets call them- main routers, and 2 of them have a large amount of
> > > traffic. So the arts file becomes too large too soon, and when im trying
> to
> > > get some info with artsnets, its really hard and takes a lot of time.
> > >
> > > I dont mind if i have lot of files at a day, it can be managed by a
> script
> > > to erase them, but ill need to cfdcollect, instead rotate his files
> every 24
> > > hours, can do the rotation every hour as an example.
> > >
> > > Thanks in advance.
> > >
> > > --
> > > Se. Alexis Fidalgo
> > > AT&T Argentina
> > >
> > >
> > > _______________________________________________
> > > Cflowd mailing list
> > > Cflowd@caida.org
> > > http://login.caida.org/mailman/listinfo/cflowd
> >
> 

----- End forwarded message -----