cflowd configuration: cflowd configuration

Next Previous Contents

## 2. cflowd configuration

`cflowd`, `cflowdmux` and the local utilities (`cfdases`, `cfdnets`, et. al.) all read configuration information from `cflowd.conf`. In a standard installation, `cflowd.conf` will be located in the `/usr/local/arts/etc/` directory.

`cflowd.conf` contains three types of stanzas: an OPTIONS stanza specifying system-wide configuration values, CISCOEXPORTER stanzas specifying configuration values for each Cisco from which we're collecting data, and COLLECTOR stanzas specifying hosts from which we permit `cfdcollect` connections.

## 2.1 OPTIONS stanza

The OPTIONS stanza in `cflowd.conf` is used to set system-wide configuration values for `cflowd`, `cflowdmux` and local clients. There should be a single OPTIONS stanza in `cflowd.conf`, and it should be the first stanza. Following are descriptions of each of the settings in an OPTIONS stanza.

### LOGFACILITY (optional)

The LOGFACILITY setting is used to set the syslog facility that will be used by `cflowd` and `cflowdmux` for logging. If unspecified, `local6` will be used.

### TCPCOLLECTPORT (optional)

The TCPCOLLECTPORT setting is used to set the TCP port on which cflowd will listen for connections from `cfdcollect`. Connections to this port are used for downloading tabular data from `cflowd` and cause the tabular data in `cflowd` to be cleared after transmission. Only hosts with a COLLECTOR stanza are permitted to connect to this port and retrieve data. Normally, a single `cfdcollect` will be running on a COLLECTOR host and be the only program to connect to the TCPCOLLECTPORT.

If TCPCOLLECTPORT is unspecified, a default value of `2056` will be used.

### PKTBUFSIZE (optional)

`cflowdmux` uses a 1 megabyte packet buffer by default, split into 2 toggle buffers in a single shared memory segment. Using the PKTBUFSIZE setting, you may change the default size of the packet buffer shared memory segment. This option is typically used to increase the size of the packet buffer.

### TABLESOCKFILE

The TABLESOCKFILE setting specifies the path to the named stream socket on which `cflowd` will listen for local table client connections. `cflowd` will accept connections from table clients on this socket. Typical table clients are `cfdases`, `cfdnets`, et. al.

### FLOWDIR

Specifies the directory in which raw flow files should be stored. This is used when `flows` is specified in a CISCOEXPORTER stanza.

### FLOWFILELEN (optional)

Specifies the length of raw flow files. `cflowd` will roll over a raw flow file when it reaches this length. `cflowd` will not truncate a raw flow in a flow file, so it typically writes to some length just below the FLOWFILELEN. If unspecified, a default value of `1048576` (1 megabyte) will be used.

### NUMFLOWFILES (optional)

Specifies the number of raw flow files to be user per router. This determines how many raw flow files will be kept by `cflowd` per router. If unspecified, a default value of `10` will be used.

### MINLOGMISSED (optional)

Specifies the threshold at which `cflowd` will syslog a message about missed flows. `cflowd` only does this when contacted by `cfdcollect`. If this value is unspecified, a default value of 300 will be used.

### Example

Below is an example OPTIONS stanza. We've specified `local6` as the LOGFACILITY, so `cflowd` and `cflowdmux` will syslog using this facility. We've specified a TCPCOLLECTPORT of 2056, so `cflowd` will listen for connections from `cfdcollect` on TCP port 2056. `cflowdmux` will listen for raw flow client connections on the named stream socket `/usr/local/arts/etc/cflowdmux.socket` as specified with RAWFLOWSOCKFILE. `cflowd` will listen for connections from table clients on the named stream socket `/usr/local/arts/etc/cflowdtable.socket` as specified with TABLESOCKFILE. `cflowd` will store raw flow files in the `/usr/local/arts/data/cflowd` directory if `flows` are specified in the COLLECT portion of a CISCOEXPORTER stanza. As specified by FLOWFILELEN, `cflowd` will roll over a raw flow file when it reaches `1000000` bytes. `10` flow files will be kept per router, as specified with NUMFLOWFILES. As specified by MINLOGMISSED, `cflowd` will syslog a message about missed flows when there are more than `300` flows missed between queries from `cfdcollect`.

    OPTIONS {
      LOGFACILITY:          local6
      TCPCOLLECTPORT:       2056
      TABLESOCKFILE:        /usr/local/arts/etc/cflowdtable.socket
      FLOWDIR:              /usr/local/arts/data/cflowd
      FLOWFILELEN:          1000000
      NUMFLOWFILES:         10
      MINLOGMISSED:         300
    }

## 2.2 CISCOEXPORTER stanza

The CISCOEXPORTER stanza is used to specify configuration values for a single Cisco router. There may be more than one CISCOEXPORTER stanza in `cflowd.conf`, with each corresponding to a Cisco router from which we would like to collect data.

### HOST

The HOST setting is used to specify the IP address of the Cisco.

### ADDRESSES

The ADDRESSES setting is used to specify the IP addresses of interfaces on the Cisco router. It's possible for flow-export packets to originate from more than one interface on a Cisco router; the ADDRESSES setting lets us specify multiple source addresses from which we'll accept flow-export data for a single Cisco router.

### CFDATAPORT

The CFDATAPORT setting is used to specify the UDP port on which `cflowdmux` should listen for flow-export packets from the Cisco router. This should match whatever you've configured as the flow-export destination port on the Cisco router.

### LOCALAS (optional)

The LOCALAS setting is used to specify the local AS of the Cisco router. This value is used when trying to fix 0 values in the source and destination AS fields in flows from version 5 flow-export and in the prefix aggregation flows in version 8 flow-export. If LOCALAS is unspecified, `cflowd` will not try to fix 0 values in the source and destination AS fields.

### SNMPCOMM (optional but recommended)

SNMPCOMM is used to specify the SNMP (v1) community name to be used when retrieving interface descriptions and IP addresses from the router (ifDescr and ipAdEntIfIndex). It should be enclosed in single quotes. Currently we can't handle a community name that contains a single quote, but this will be fixed soon.

### COLLECT

The COLLECT setting is used to specify the types of data that should be collected from the flow-export data for the Cisco router. There are several types of data which can be collected:

- `asmatrix` - AS matrix (packets and bytes from source ASes to destination ASes)
- `netmatrix` - net matrix (packets and bytes from source networks to destination networks)
- `portmatrix` - port matrix (packets and bytes from source ports to destination ports)
- `ifmatrix` - interface matrix (packets and bytes from input interfaces to output interfaces, by ifIndex)
- `protocol` - protocol table (packets and bytes per IP protocol)
- `nexthop` - IP nexthop table (packets and bytes per IP nexthop)
- `tos` - TOS table (packets and bytes per IP TOS)
- `flows` - raw flow data

### Example

An example CISCOEXPORTER is shown below. It is for a router with an IP address of 204.212.46.1 (the HOST) that is configured to flow-export to port 2055 (the CFDATAPORT) on the host running `cflowd`. We specified two addresses for the Cisco router: 204.212.46.1 and 204.212.45.14. These correspond to the IP addresses of different interfaces on the Cisco router. We specified a LOCALAS of 195, corresponding to the local AS of the Cisco router. We used COLLECT to list the types of data which `cflowd` will collect for the Cisco router using the flow-export data from the router.

    CISCOEXPORTER {
      HOST:         204.212.46.1            #  IP address of Cisco sending data.
      ADDRESSES:    { 204.212.46.1,         #  Addresses of interfaces on Cisco
                      204.212.45.14 }       #    sending data.
      CFDATAPORT:   2055                    #  Port on which to listen for data.
      SNMPCOMM:     'public'
      LOCALAS:      195                     #  Local AS of Cisco sending data.
      COLLECT:      { protocol, ifmatrix, portmatrix, netmatrix,
                      nexthop, asmatrix, tos, flows }
    }

## 2.3 COLLECTOR stanza

The COLLECTOR stanza is used to hold configuration values for a host running `cfdcollect`. In a standard configuration, there will only be one or two of these, since a single `cfdcollect` host is normally used to collect data from all instances of `cflowd`. However, there may be more than one entry (for example, you may have a hot backup host on which you will run `cfdcollect` when the primary `cfdcollect` host is down).

### HOST

The HOST setting is used to specify the IP address of the host running `cfdcollect`.

### ADDRESSES

The ADDRESSES setting is used to specify the IP addresses of the host running `cfdcollect`. `cflowd` will permit connections from `cfdcollect` originating from any of the IP addresses in the list.

### AUTH

Currently unused.

### Example

Below is an example COLLECTOR stanza. This says that we will allow connections from `cfdcollect` that come from 195.83.243.2 or 195.83.241.9, and we will assume that connections from either of these addresses are from the same host.

    COLLECTOR {
      HOST:         195.83.243.2    # IP address of host running cfdcollect
      ADDRESSES:    { 195.83.243.2, 195.83.241.9 }  # other addresses of host
      AUTH:         none
    }

Next Previous Contents