To access the Flow Collector Health page
Details of the Flow Collector page
The Flow Collector Health page displays detailed statistics on the flow data performance and data loss of flow collectors.
To access the Flow Collector Health page:
- In the Main Menu, click System Information.
- In the System Information table, click the icon (either a green tick or a red cross) in the Flow Collectors column.
- This will take you to the Flow Collector Health page.
Details of the Flow Collector Health page:
The Flow Collector Health page contains two tables:
- Performance (past hour)
- Flow Data Loss
Performance (past hour):
This table details flow performance metrics for the past hour.
Row Name | Row Description |
---|---|
Incoming data rate | number of bytes per second received on the flow collector port. |
Packet processing rate | rate of incoming export packets. Each packet may contain multiple flow records. |
Flow processing rate | rate of the flows from the flow collector processes. |
Flow compression | degree of compression of the original flow data in a five minute interval. |
Excluded flows (0 exclusion rules) | number of flows dropped due to flow collection not being enabled on a device or due to exclusion rules. |
Time to write flow buffer to disk | time spent over a five minute period performing database writes. |
Flow Data Loss:
This table details flow packets dropped across the previous hour and 24 hours.
Dropped packets indicate the flow collector process is not fast enough to process incoming packets.
Row Name | Row Description |
---|---|
Packet buffer (limit = 10,000) | number of packets dropped due to the front packet buffer being full. The size of the buffer is specified in brackets. |
Unrecognized packets | packets received that the flow collector cannot parse. |
Flow buffer (limit = 1,000,000) | number of flows that cannot be compressed by flow buffers and have therefore been dropped, because the buffer limit has been reached. |
Filesystem write | number of flows that cannot be stored in the database and have therefore been dropped, because the database limit has been reached. |
NetFlow V9 (X templates) | number of unique NetFlow V9 templates received. |
Missing template (suppression - 30 min) | number of flows lost due to template unavailability. Flows with a missing template are ignored for the first thirty minutes after receiving the first flow, giving time for templates to be received. |
IPv6 template (X templates) | number of flows lost due to non-support for IPv6. Flows with IPv6 addresses are dropped. |
Incomplete template (X templates) | number of flows lost due to the template being too incomplete to correctly recognize a flow. |
Comments
0 comments
Please sign in to leave a comment.