Table of Contents (Start)

Flow Interface Manager

This documentation applies to NMS version 5.4. An online version of the software can be found here.

The Flow Interface Manager enables you to limit the flow data that SevOne NMS processes from specific devices and from specific interfaces. When you enable devices to send flow data to SevOne NMS, SevOne NMS allows and processes all flow data by default. Devices have the potential to send large amounts of flow traffic. The rules you define here override the global flow rules you define on the Flow Rules page.

To access the Flow Interface Manager from the navigation bar, click the Administration menu, select Flow Configuration, and then select Flow Interface Manager.

images/download/attachments/11509891/flowinterfacemanager.png

Device Level Flows

The list displays all devices from which SevOne NMS can receive flow data. Click the Display drop-down to display rules for All Sources, Allowed Sources, or Denied Sources.

Some flow devices only record data for a selection of messages that the device encounters based on a sample flow rate. The device notifies monitoring systems about only a fraction of its total traffic. The sample rate enables SevOne NMS to scale the data to compensate for the lack of notification of sampled data. The Sample Rate column appears when you select the Display Flow Sample Rates check box on the Cluster Manager Cluster Settings tab.

Device – Displays the name of the device when SNMP resolvable. Displays Unknown if you do not enable the SNMP plugin for the device.
IP Address – Displays the IP address of the device.
Total Flows - Displays the number of flows processed per second across all interfaces on the device over the past minute. Malformed flows and flows denied by a rule are not processed. The flow rate on the Flow Interface Manager is calculated after duplication.*
Number of Interfaces – Displays the number of interface on the device from which flow data is received.
Allowed Direction - Displays the number of interfaces from which flow data is processed and the number of directions of flow data received. Each interface can have incoming flow and outgoing flow and you can define rules to deny flow by direction.
Sample Rate - Displays the flow data sample rate when the interface sends sampled flow data.
- n/a – Flow data has yet to be received from the interfaces.
- 1X - Sample rate is 1-to-1 (data is not sampled).
- <n>X – The sample rate (e.g., if 1 packet out of 100 packets is received, this column displays 100X).
Peer - Displays the name of the peer that receives the flow data.

*The Flow Interface Manager displays the rate of flows over the past minute for each interface and direction after SevOne NMS duplicates flows that lack directional information. Since NetFlow v5 only exports information about the incoming interface, SevOne NMS duplicates the flow statistics for v5 NetFlow to factor for outgoing flows on devices that use v5 NetFlow. Therefore, if your network only uses v5 NetFlow, you can expect the flow rate to be double the actual rate of flows that arrive. The flow rate on the Flow Interface Manager is therefore different from the flow rates that display in FlowFalcon reports and on the Cluster Manager Peer Overview tab which use different calculations.

Manage Device Level Flow Rules

Select the check box for each device to manage and the following controls enable you to manage the device level flow rules in the list.

Select Allow Flows to process the flow data across all interfaces on the devices.
Select Deny Flows to not process the flow data for the devices.
Select Delete Device Rules to delete the rules at the device level.
Click and select Purge Device Flows to delete the flow data processed for the devices.

Interface Level Flows

images/download/attachments/11509891/editnew.png - Click to display the Edit Flow Interfaces pop-up that enables you to define flow rules at the interface level. The Edit Flow Interfaces pop-up displays the following information for each individual interface on the device.

Interface - Displays the interface number the device sends to SevOne NMS.
Last Seen - Displays the last time flow data passed through the interface.
Last Write - Displays the last time flow data from this interface was written to the database. This is either the last time flow data was received for the interface or the last time SevOne NMS wrote flow data to the database based on the Write Interval you define on the Cluster Manager Cluster Settings tab.
Direction - Displays Incoming for incoming flow data or displays Outgoing for outgoing flow data.
Flows/Sec - Displays the number of flows processed per second across the interface over the past minute.
Sample Rate - Displays the flow data sample rate when the interface sends sampled flow data. See the Manage Device Level Flows section above.
Permission - Displays Allow when data is processed across the interface. Displays Deny when data is not processed across the interface.
Creator - Displays System when SevOne NMS creates the interface or a FlowFalcon Interface rule updates the interface. Displays User when a user creates or updates the interface.
Reason - Displays Normal when data can be processed across the interface. Displays Exceeds Capacity when the element count exceeds the peer license capacity and flows cannot be processed for the interface. For licensing purposes, each interface is equal to 300 elements/objects.

Manage Interface Level Flow Rules

Select the check box for each interface to manage, click images/download/attachments/11509891/gear.png , and then select one of the following options.

Select Allow Flows to process the flow data across the interfaces.
Select Deny Flows to not process the flow data across the interfaces.
Select Delete Interface Rules to delete the interface rules.
Select Purge Interface Data to delete the flow data for the interfaces.