Selecting NetFlow Collector in the left panel of the Options tab provides the following view, where you can configure NetFlow Collector settings in ExtremeCloud IQ Site Engine.
Changing a value from the system default causes a Default Value button to appear. Selecting this button changes the field back to the system default value.
Configuration
- Enable NetFlow Collector
- Select this checkbox to enable NetFlow packet processing on the ExtremeCloud IQ Site Engine server. Deselecting this checkbox disables all other fields in this panel and turns off NetFlow for troubleshooting purposes. Whether NetFlow is enabled or disabled, a message is logged to the event log as well as the ExtremeCloud IQ Site Engine server log. When NetFlow is disabled, the Application Flows report on the Flows tab is cleared.
- Flow Collector Filter
- Use this field to filter all incoming flows as they are processed by
the flow collector. Flows not matching the filter are discarded and not
maintained in memory on the server. If you add a filter here, the
current flows stored in the cache are trimmed to only include matching
flows.
Use this option if you want to use flow collection to look for specific results, but not process unrelated flows. For example, to only process flows pertaining to a particular subnet.
- Export Interval
- This is the active timer that determines the maximum amount of time a long-lasting flow remains active before expiring. When a long-lasting active flow expires due to the active timer expiring, another flow is immediately created to continue the ongoing flow. The ExtremeCloud IQ Site Engine flow collector rejoins these multiple flow records to report a single logical flow.
- Maximum Aggregate Flows to Maintain in Memory
- This indicates the amount of memory used to store aggregated flows.
- Maximum Number of Flows Allowed per Table View
- This indicates the maximum number of flows displayed in NetFlow reports.
- Throttle Flows When Maximum Exceeded By (percent)
- Flow collection is throttled when the Maximum Flows to Maintain in Memory is exceeded by the percentage entered here.
- Worker Thread Queue Size
- Decoded flow records are put into one of several fixed-size queues for processing. If the decoding rate exceeds the processing rate, the queue can overflow. This option allows you to configure the queue size (number of flow records).
Alarm Dispatcher
- Flow Alarm Service Period
- This controls how often the queue is checked for matched flows to process. The dispatcher runs one time every service period. So by default, the dispatcher processes matches every 5 seconds.
- Maximum Flow Alarm Queue Size
- The maximum number of matched flows queued. By default, the dispatcher drops matched flows after 1000 matches are queued.
- Maximum Flow Alarms Serviced Each Period
- The maximum number of matched flows pulled from the queue for processing during a service period. By default, the dispatcher processes 100 matches every service period.
Socket
- NetFlow Socket Buffer Size (bytes)
- The buffer size (in bytes) set aside by the ExtremeCloud IQ Site Engine server for buffering incoming flows.
- NetFlow Socket Data Size (bytes)
- The socket data size in bytes. Do not change this setting unless it is required on your network.
- Send/Receive NetFlow Data on Socket
- The port on the ExtremeCloud IQ Site Engine server that listens for flow collection data. If you change this port number here, you also need to reconfigure the port number on the switch.
- Socket Receive Queue Size
- Network packets are retrieved from a datagram socket and put into a fixed-size queue for decoding into flow records. The queue can overflow if the receive rate exceeds the decoding rate. This option allows you to configure the queue size (number of network packets).
Name Resolution
- NetFlow Host Name Resolution
- Select this option to resolve host names to IP addresses and IP addresses to host names, if possible. This option enables host name resolution for NetFlow only. Host name resolution for ExtremeCloud IQ Site Engine is enabled globally using the ExtremeCloud IQ Site Engine Name Resolution option. The Name Resolution option must also be enabled for this NetFlow option to take effect.
- NetFlow Port Name Resolution
- Select this option to resolve device port indices to port names and port aliases, and device port names and port aliases to port indices, if possible. This option allows you to disable port name resolution for NetFlow only. (Port name resolution is enabled globally using the Name Resolution option.)
Version 9 Template
- NetFlow v9 Template Refresh Rate (packets)
- The number of export packets the flow sensor sends before retransmitting a template to the collector when using NetFlow Version 9.
- NetFlow v9 Template Timeout
- The amount of time the flow sensor waits before retransmitting a template to the collector when using NetFlow Version 9.
For information on related help topics: