sFlowTrend-Pro

sFlowTrend-Pro is a Java application, which monitors sFlow^® enabled network switches, routers and hosts. It is designed to be easy to install and use, and to allow network and host problems to be understood and resolved quickly. Summaries and detail of network traffic can be displayed for the whole network, on a per-switch or per-interface level, thresholds used to provide alerts to abnormal traffic conditions, and historical traffic patterns reviewed to determine when changes occurred. Host performance metrics can be monitored for an entire data centre.

As its name implies, sFlowTrend-Pro only monitors sFlow enabled switches, routers and hosts. For the sake of clarity, in the remainder of this documentation network devices will be referred to as switches; if there is an instance where a router has different behavior or requirements, this will be highlighted.

sFlowTrend is a limited functionality version of sFlowTrend-Pro. Throughout this documentation, sFlowTrend-Pro will be used to refer to sFlowTrend and sFlowTrend-Pro. Features that only apply to sFlowTrend-Pro will be highlighted with .

sFlowTrend-Pro runs as a client/server application. The sFlowTrend-Pro server runs as a service, continuously in the background, collecting data even when no-one is logged in. A client is used to run the GUI, and view the data from the server. It connects to the server over HTTP or HTTPS using a RESTful API (see sFlowTrend-Pro REST API). Any modern web browser which supports HTML5 can be used to access the GUI (web client). The web client can be run on the same system as the server, or a different one, and multiple web clients can connect to the same server at once.

The sFlowTrend-Pro service is installed via a traditional installer. The installation starts the service. After each reboot, the service is started automatically and data collection will resume. The installation also includes a web server which allows you to run the web client GUI from a web browser pointed at http://[hostname]:8087/sflowtrend (or over https https://[hostname]:8443/sflowtrend). See Connecting to sFlowTrend-Pro.

sFlowTrend-Pro has an optional user authentication feature (see Configuring user authentication ). If enabled, only users who are authenticated with a password can access the system and view data. Additionally, some functionality, for example adding new switches to monitor, is only available to administrators. If a particular part of sFlowTrend-Pro can only be used by an administrator, this is highlighted with in this documentation. Note that if user authentication is not in use, then this does not apply and everyone can access all of the features.

sFlowTrend-Pro follows a familiar layout of many applications.

sFlow^® is an industry standard technology for monitoring traffic in computer networks. The sFlow standard is designed and maintained by the industry group (https://sflow.org). Unlike other monitoring technologies, it is very efficient, and so can be used in modern high-speed networks. It also operates at layer two in the network, which means that switched as well as routed traffic can be monitored. Because the overhead of running sFlow on a network is low, it is recommended that sFlow is enabled on as many switch ports as possible in a network. This allows as complete a picture as possible of the traffic to be created. sFlowTrend-Pro helps you automatically configure sFlow on all interfaces, where possible.

sFlow is supported by most network switch manufacturers. An up-to-date list is maintained at https://sflow.org/products/network.php. Even if some of the switches in a network do not support sFlow, because most traffic transits several points in the network, good information on traffic can still be obtained.

With the release of host sFlow, the benefits of sFlow can also be realized for virtual switch, host, and application monitoring. Over time, it is expected that system vendors will integrate host sFlow into their products. In the meantime, you can add sFlow to any host by using the open source host agent, available from https://sflow.net, the Host sFlow site.

Please follow these steps to start monitoring your network traffic with sFlowTrend-Pro. It will also be useful to have the documentation available for your network switches.

You can navigate around sFlowTrend-Pro by selecting tabs in the Tab bar to view and analyze the sFlow data. In addition, sFlowTrend-Pro integrates with the browser history. When you move to a different tab or you change the settings in the viewed tab (for example changing the selected switch, interface or chart in the Network  Top N tab), the tab and its settings changes are automatically saved in the browser history. You can use browser back and forward buttons to move backwards and forwards through the history of viewed tabs and their settings.

You can also use the browser bookmark functions to bookmark favorite tabs and their settings so that you can return to a tab configured with the saved settings at a later time. This is particularly useful if your favorite tabs include many special settings (eg filters).

You can access the sFlowTrend-Pro on-line help by clicking the help icon in the title bar.

If you have trouble with getting sFlowTrend-Pro to work correctly, please refer to Troubleshooting and frequently asked questions. If you still need help, please submit a support request at the InMon Corp. customer portal (https://www.myinmon.com) . Community-based support is available via the sFlowTrend Google Group (https://groups.google.com/group/sflowtrend). There is also a blog that gives tips and tricks for using sFlowTrend-Pro (https://blog.sflowtrend.com).

For sales questions, please send an email to sales@inmon.com.

sFlowTrend-Pro is installed using an installer, obtained from https://www.myinmon.com. Download the appropriate installer file for your system: either Windows or Linux. For Linux, you can download either an interactive installer, a Debian package (.deb file), or an RPM file, depending on your preference. If you are installing on Windows or using the interactive installer on Linux, follow the instructions in Using the interactive installer. For more information on installing with a Debian or RPM package, see Installing with a Debian or RPM package.

If you would like to run sFlowTrend-Pro on a Mac, we suggest a Linux VM running under Virtual Box, Parallels or VMWare Fusion, or in a container under Docker (a prebuilt Docker image is available at https://hub.docker.com/r/sflow/sflowtrend/).

After sFlowTrend-Pro is installed, you must configure a license. When the client first connects to the server, a dialog should pop up automatically. This dialog allows you to enter the license number (or choose to use the free version, sFlowTrend). If the dialog does not appear, or you would like to change the license, see Configuring the license for more information. Note that normally sFlowTrend-Pro will use the Internet to download the license key, once the license number has been entered. If a proxy configuration is required for the server to connect to the Internet, please make sure that the proxy is correctly configured (see Proxy configuration).

On initial installation, until you configure the license you cannot use the rest of the product; this means that the proxy also cannot be configured. To work around this, if you have to configure a proxy, first select the option to use the free sFlowTrend license, then configure the proxy, and finally go back to the license dialog and enter your actual license number.

If the system has no Internet connectivity at all, then the license key can be entered manually. First, request a manual license key using a support request at https://www.myinmon.com. Once you have the key, then enter it as described in Configuring the license.

You use sFlowTrend-Pro by connecting to it using a web browser (HTML 5 and JavaScript is required in the browser; most modern browsers will work, including Internet Explorer 11 or later, or recent versions of Safari, Firefox or Chrome). Multiple users can connect to the server allowing different people in your organization to access the data easily.

In a web browser go to the URL http://[hostname]:8087/sflowtrend for a regular connection, or https://[hostname]:8443/sflowtrend for https. The ports used can be customized as described in [advanced.configuration.webserver.port] and [advanced.configuration.webserver.https.port]. Please make sure that no firewalls are blocking these ports on the client system, the server, or in the network.

To allow the sFlowTrend-Pro server to receive sFlow from the devices that you are monitoring, the incoming sFlow data must be allowed to pass through any firewalls. When using a host firewall with a service, the firewall configuration can be confusing, since the configuration must correspond to the user that the service is running as. See What firewall requirements does sFlowTrend-Pro have? if you are having difficulty in receiving sFlow.

After completing the installation of sFlowTrend-Pro on Linux, the sFlowTrend-Pro service will be created automatically (as /etc/init.d/sflowtrend-server) and started. The service will also be registered to automatically start when the system is booted, using chkconfig. This is only possible for Linux distributions that use the chkconfig command. Some distributions use other methods for starting services automatically. If the Linux that you are using does not use chkconfig, then you should enter the /etc/init.d/sflowtrend-server service manually as a service to be started at boot time.

If you are installing sFlowTrend-Pro on a system which does not have a graphical user interface, you can either install using a package (see Installing with a Debian or RPM package), or using the interactive installer but with a terminal interface. To do this, add the command line option -c to the installer, eg: # /bin/sh installer -c. This will step through the same installation steps that are used for the graphical installer, just using a terminal interface. Please take care to enter the data correctly, as the command line interface is more difficult to use than the graphical interface.

The amount of memory required by the sFlowTrend-Pro service varies considerably, depending on how many sFlow agents are monitored, and the quantity and type of network traffic. The default memory available to the service is generous and suitable for most installations. However, if memory runs low then events will appear in the event log warning of this, and performance of sFlowTrend-Pro may become poor.

To increase the memory available to the service, first go to the bin directory, in the directory on the server where sFlowTrend-Pro was installed. Here there should be a file named sflowtrend-server.vmoptions. Edit this file with a text editor, and add a line to the end with this format:

This will change the memory available to be 1800 MB. The memory can also be reduced in a similar way. After making this change, the sFlowTrend-Pro service must be restarted for the change to take effect.

To allow https to run on the sFlowTrend-Pro server, an https certificate is required. When the sFlowTrend-Pro service is first started, a default certificate will be installed with a generic localhost hostname.

It is possible to configure a different certificate to use for the server, if for example, you wish to use a certificate signed by a local enterprise certificate authority. To do so, you will need to use the command keytool, which is included with the Java Development Kit (JDK), available from Oracle or the OpenJDK.

First stop the sFlowTrend-Pro service. Then create the keystore to use with keytool. The keystore must contain a trusted certificate entry (including a private key), and should be placed in the sFlowTrend-Pro home directory. You should then create the custom configuration options [advanced.configuration.server.https.keyStore], [advanced.configuration.server.https.alias], [advanced.configuration.server.https.password] and [advanced.configuration.server.https.keyPassword] (these are only required if the desired values are different from the defaults). When the sFlowTrend-Pro service is then restarted, the new certificate from the keystore will be used.

If, at any time a new default certificate is required, just stop the sFlowTrend-Pro service, delete the default keystore, and restart the service. A new default keystore will be automatically created.

The sFlowTrend-Pro server can force clients to always use https, rather than http. For information on this please see the [advanced.configuration.webserver.forceHttps] custom configuration option.

The status section of the dashboard shows a summary of the overall system, which can be useful for basic troubleshooting.

Some of the information shown:

The thresholds section of the dashboard shows the current status of each of the top level thresholds.

Each threshold category (Utilization, Unicasts, Broadcasts, Multicast, Errors, Discards) indicates the most severely violated threshold across all the switches that you are monitoring. The color of the bar indicates how severe the threshold violation is (green is normal, yellow is marginal and red is critical). Further detail of the threshold value is indicated by how far to the right the threshold bar is within the indicator. For more information on how thresholds work, see Using and configuring thresholds.

You can drill-down to the causes of any threshold violation by clicking on a threshold indicator on the dashboard. This will take you to the thresholds screen, showing the thresholds for all the switches being monitored, sorted by the threshold category that you clicked on. For example, if you click on the broadcast threshold indicator in the dashboard, you will be taken to the thresholds view for all switches, sorted by broadcasts (highest threshold value first). This shows you the detail of the broadcast thresholds across the whole network, and allows you to find the switches contributing the most to threshold violations quickly.

Note that if a switch is deleted from sFlowTrend-Pro, if it was contributing to any of the thresholds shown on the dashboard, then this contribution will not be removed until the end of the current minute.

Three 'top interfaces' charts are provided on the dashboard.

These charts show, in bar chart format, the top 10 switch interfaces sorted by utilization, total frames (unicasts, multicasts and broadcasts), and errors and discards. The bar shows the average over the previous minute. These charts are designed to give you a summary view of the busiest interfaces, or interfaces which are experiencing the highest number of issues. Clicking on any of the bars allows you to drill-down to the traffic charts for that specific interface.

Note that if a switch is deleted from sFlowTrend-Pro, if it was contributing to any of the top interface bar charts shown on the dashboard, then this contribution will not be removed until the end of the current minute.

The Interfaces tab provides a tabular, sortable view of the values for the most recent minute, of the important interface counters (Utilization(%), Unicasts/s, Broadcasts/s, Multicasts/s, Errors/s, Discards/s) for the currently selected switch.

This tab is useful for comparing the usage of interfaces based on absolute values. For example to compare the unicasts/s of interfaces with the same ifSpeed on the selected switch (see Selecting a switch), first click with the Left mouse button on the Unicasts/s column heading, then click with the Shift+Left mouse button on the ifSpeed column heading. This will cause the table to be sorted by unicasts/s and then ifSpeed.

The Progress indicator shows when the counter values will next be updated. When sFlowTrend-Pro first starts collecting sFlow data from a switch, the first counter values will be available after 2 minutes. The counter values will then be updated every minute.

To investigate the cause of the usage values for an interface of interest, click on the chart button in the row for the interface. This will automatically make the Counters tab visible with the interface of interest selected.

Interface counter charts show how the overall network traffic load on an interface varies over time. These charts are generated from the interface counter data exported by sFlow. Interface counters charts are represented as stacked area charts.

This tab includes a control bar that allows you to select the switch (Selecting a switch) and interface (Selecting an interface) for which you would like to view trends in counter values, the counters charts to display and the specific time interval (see Selecting a time period ).

With sFlowTrend, or with sFlowTrend-Pro when the Time setting is relative to now (for example Last hour — see Selecting a time period ), these charts are automatically updated when the next data point is available. The Progress indicator shows how long it will be before the chart is next updated.

The Top N tab displays charts that show the top N contributors to the network traffic and how the top N contributors change over time.

This tab includes a control bar that allows you to select the switch (Selecting a switch) and interface (Selecting an interface) for which you would like to analyze and view traffic data, and the type of chart to display. You can also select a specific time interval (Selecting a time period ) and filter on specific traffic (Filtering).

With sFlowTrend, or with sFlowTrend-Pro when the Time setting is relative to now (for example Last hour — see Selecting a time period ), these charts are automatically updated when the next data point is available. The Progress indicator shows how long it will be before the chart is next updated.

The Circles tab allows you to visualize the traffic flows between groups of addresses. For example, grouping end host addresses for each department allows you to view traffic between departments. Understanding network traffic in this way allows you to make accurate capacity planning decisions (eg, do I need to upgrade the link between the finance and the HR department?) and help enforce usage policies (are unauthorized hosts accessing the admin servers?).

A Circles chart shows the top 100 traffic flows, with the end hosts which are responsible for the top 100 flows displayed as black squares, and clustered together in circles. Lines, colored according to the traffic type, join the end hosts, of a flow. The width of a line is scaled according to the volume of traffic in the flow. The traffic type (or protocol) for each color is shown in the chart legend. The legend entries are ordered left to right, ordered by the volume of each traffic type.

The Circles tab includes a control bar that allows you to select the switch (Selecting a switch) and interface (Selecting an interface) for which you would like to analyze and view traffic data, whether the top flows should be determined by frames or bytes, and whether the clusters and flows should be labelled automatically. You can also select specific time intervals and filter on specific traffic.

The Root cause tab helps you to understand the root cause of traffic on a switch or interface, and optionally the cause of a threshold being tripped.

To view data for a specific switch, use the Switch selector in the control bar to select the switch you are interested in. The Switch selector lists the switches that have been included in the sFlowTrend-Pro configuration, or that sFlowTrend-Pro is receiving sFlow data from (see Configuring agents in sFlowTrend-Pro for details on configuring switches in sFlowTrend-Pro). A switch is listed using its SNMP IP address, sFlow agent address, DNS Name, or sysName (see Setting the switch and interface naming policy).

In the Top N and Circles tabs, the Switch selector also includes an option All switches. When you select All switches, the resulting charts display the overall traffic through the network, such that, if traffic crosses multiple switches, the traffic is counted only once. If you would like to restrict the analysis to specific switches, you can do so by using a filter, for example: agent == "10.0.0.250" || agent = "10.0.0.248", where 10.0.0.250 and 10.0.0.248 are the sFlow agent addresses of the switches that you are interested in (see Filtering for specific traffic for more information of filtering). The All switches option is not available in the Interfaces or Counters tabs, since interface counters are specific to a specific switch and interface.

Switches shown in italics in the selection list are disabled, meaning that data is not being stored for these switches. See Configuring agents in sFlowTrend-Pro for help on enabling and disabling switches. Multiple switches can be enabled in sFlowTrend-Pro , whilst sFlowTrend allows five switches to be enabled at a time.

The Counters, Top N, and Circles tabs allow you to view data for a specific interface. Use the Interface selector in the control bar to select the interface that you are interested in. The Interface selector lists the interfaces for the currently selected switch, for which sFlow data is being received and stored. An interface is listed using its ifIndex, ifName, or ifAlias. (see Setting the switch and interface naming policy). Changing the interface selection causes a chart for the newly selected interface to be displayed.

In the Top N and Circles tabs, the Interface selector also contains an option All. Selecting this option allows you to view traffic flows through the whole switch (across all interfaces). This option is not available in the Counters tab, since counter charts can only display data for a single interface.

The Statistics sub-tab allows you to compare performance of all hosts over the last minute. Use the View selector to select the group of performance metrics (CPU, Memory, Disk, Network) of interest.

The selected performance metrics for the last minute are displayed in a sortable, hierarchical table, with one row for each host. Physical hosts are shown at the top level of the hierarchy. If the virtual-machines of a physical host are being monitored with sFlow, you can view the performance metrics for the virtual-machines by expanding the physical host.

This view is useful for comparing the current performance of hosts. For example, to compare the CPU utilization of all the hosts, click with the Left mouse button on the % CPU column heading, to sort the hosts by CPU utilization.

To view the trend in performance for a host, click with the Left mouse button on the row of data for that host. The tab will then change to the Charts sub-tab, showing a trend of the performance metrics for the selected host for the last hour.

The Charts sub-tab allows you to view a trend in performance for a host. Use the Host selector to select the host of interest and the Chart selector to select the performance metrics to trend. You can also select specific time interval (Selecting a time period ) over which to trend the data.

The counters tab shows how the overall volume of application transactions varies over time. It uses stacked area charts to display the application performance counters.

This tab includes a control bar which allows you to select the host and service for which you would like to view trends in transaction volumes, the application performance counters chart to display and the specific time interval (see Selecting a time period ).

The top N tab displays trend charts showing the top contributors to application transaction volume and how the top contributors vary over time. For example, you can view the top URIs for a specific host or all hosts.

This tab includes a control bar which allows you to select the host and service for which you would like to view top n trend data and the type of chart to display. You can also select a the specific time interval (see Selecting a time period ), and filter on specific data (see Filtering).

You can view and configure the thresholds for all switches, or for all interfaces on a specific switch. Use the View selector to select the view that you would like. The options are:

The current threshold values are shown in the table. Each column can be sorted by clicking on the header column. If you click on a column containing thresholds, then the column will be sorted by the current threshold values in the column. This is an easy way to find the thresholds with the highest values (ie, those that have 'most exceeded' the configured thresholds).

Every threshold has a current value, which is displayed by the threshold indicator . The value ranges from 0 - 100%, and the position of the bar in the indicator shows this value. In addition, as the threshold value exceeds predefined levels, the color of the indicator will change. If the threshold value is below the normal level, then the indicator is shown in green. As the threshold value reaches 70%, the threshold becomes marginal, and is shown in yellow. At 90%, the threshold is critical, which is indicated by red.

The value of the threshold is defined by two factors: the trigger, and how long the threshold must have triggered for. For example, for the errors threshold, you might consider that the trigger is 5 errors per second. The duration might be 4 out of the previous 10 minutes. If the number of errors per second was 5 or more, in at least 4 out of the previous 10 minutes, then the threshold value would be 100%. The percent value is a combination of how long the trigger was exceeded for, relative to the configured setting, and how close the parameter being monitored was to the trigger.

To make it easier to find interfaces which have exceeded thresholds, the value of the threshold propagates up from a switch interface to the overall threshold value for the switch, and from there to the overall threshold value for the network as a whole. The maximum threshold value propagates up, so that the overall value for a switch is the largest of the values for each of its interfaces.

Thresholds can be set on six different parameters:

When viewing the threshold table, you can click with the Left mouse button on any threshold indicator to investigate the root cause of the threshold value (see Root cause analysis).

Clicking with the Left mouse button on a switch in the threshold table, the table will change to display the thresholds for all interfaces of the selected switch.

Thresholds can be defined per interface, per switch, or globally. If a threshold is defined for a switch, then that threshold setting is used for each of the interfaces of the switch, unless specific thresholds for interfaces themselves are defined. Similarly, the global threshold setting is used for all switches and interfaces, unless overridden at the switch or interface level.

A threshold is configured using the edit threshold dialog. This can opened in a number of ways:

A useful way to see which thresholds have been customized is to select Customized thresholds to view. This will show all the switch and interface thresholds which have been customized, allowing their status to be observed, and their configuration changed.

When you open the edit threshold dialog, you can then enter the settings desired for each threshold parameter.

See Threshold values and types for a description of the settings for each threshold. By default, a switch threshold will be set to the global threshold setting, and an interface threshold will be set to the threshold setting for its switch. To customize the threshold, first uncheck the Use global thresholds (for a switch) or Use switch thresholds checkbox (for an interface), to allow the settings to be changed. If you want to remove the custom settings, and revert to the default, just re-check the checkbox.

When viewing the threshold table, you can click with the Left mouse button on any threshold indicator; a menu will be shown that allows you to drill-down further and determine the cause of the threshold violation. If you click on a switch threshold, then you can select Root cause from the menu which will take you to the Network, Root cause tab configured to analyze the selected threshold for all interfaces of the switch (see Root cause). If you click on an interface threshold, then you can choose View chart, which will take you to the Network, Counters tab configured with the selected interface and counters chart, or you can choose Root cause which will take you to the Network, Root cause tab configured to analyze the selected threshold and interface (see Root cause).

The Reports sub-tab includes a reports browse pane that allows you to view existing report definitions, create and delete report definitions, and add and delete sections to report definitions.

When you first install sFlowTrend-Pro a number of example report definitions will be installed in the System reports folder.

The Reports sub-tab also includes a report settings pane that allows you to change the settings for a report and its sections. It also includes a number of controls:

The Scheduled reports sub-tab gives a tabular view of all the reports that have been configured to run on a schedule. The table includes a row for each scheduled report. For each currently scheduled report, the table gives the current state of the report, the schedule the report is running on (in cron syntax), when the report was last run on the schedule, and how long it took to run.

The state of a scheduled will be shown as Time exceeded if, when the last time the report was run on the schedule, the configured Max run time was exceeded and the report run was cancelled automatically.

The state of a scheduled will be shown as Cancelled if, when the last time the report was run on the schedule, the report was cancelled manually while it was running (see Cancelling a running scheduled report ).

Clicking on the report name will take you to the Reports sub-tab with the report selected so you can easily view and edit the report definition and settings.

The Time selector includes the following, commonly used, time selections:

The Time selector also includes back [] and forward [] buttons that can be used to view data for the previous or next time period. For example if the time selection is Last 6 hours and the current time is Mon 21 Dec 2015, 12:53, clicking on the back arrow will cause the previous 6 hours of data, ending at Mon 21 Dec 2015, 06:53, to be displayed (using the Custom time selection). The back and forward buttons will be inactive if the current time selection is at the beginning or the end of the stored data.

When a non-custom time period is selected, the displayed chart will be updated automatically when the next data point is available, thus displaying a rolling window of data. The Progress indicator will show when the chart will next be updated.

When you choose a time selection which has an interval size greater than 1 minute, the Progress indicator will have two parts. The outer part will show progress through the current minute, whilst the inner part will show progress through the chosen interval (ie how long until the next data point will be available).

You can select a time interval to view in more detail by dragging the mouse over the chart. As you drag the mouse the time selection is shown by highlighting in the region in the chart. When you release the mouse, a new chart will be displayed for the Custom period between the chosen start and end times and using the smallest possible interval size (ie the most detailed data that can be displayed for the period). Since this new chart is using a Custom time selection, the new chart will be static and will not be updated as more data becomes available.

If you find that a mouse drag is detected when you intend to click on a bar to select a specific interval in a Top N chart, you can use the Control+Left mouse button (or on a Mac Command+Left mouse button) to select the bar.

The filter is activated by clicking on the filter button (if you are currently viewing a counters chart, then the filter button is not present). If the filter is active, then the button is shown without a red line, , and the filter bar is displayed. If it is inactive, the button is drawn with a red line thought it, and the filter bar removed. The current filter can be activated and deactivated by repeatedly clicking the button. This does not remove the text of the filter in place, this makes it easy to see the effect of filtering and not filtering your data.

Filters are created by entering the filter into the filter bar. The filter can be specified just by typing the appropriate expressions into the filter bar, or to make it easier you can use the filter builder.

To bring up the filter builder, click the Edit button at the right-hand end of the filter bar. The filter builder bar will appear below the filter bar.

In the filter builder, you can select the term that you want to filter on, a relational operator (eg == for equality), and a value. For example, to filter on web traffic, you would select tcpServerPort for the filter term, the equality operator, and enter 80 for the value. Then, clicking on the Add button adds this expression to the filter.

You can combine many different expressions together, using logical operators (|| for or, && for and). For each expression you want to add to the filter, click the || or && button as appropriate (you can also use parenthesis to ensure the correct order of evaluation), then select the expression you want and click Add.

When the filter is complete, apply it by clicking the OK button at the right of the filter bar. The chart will be redrawn, using only data that matches the filter. The current filter is displayed at the top of the chart, to remind you how the data was filtered. If there was an error in the filter, then instead of the chart an error message will be displayed. Sometimes, it can be difficult to understand the error messages. Common errors are omitting quotes around an address, or using || or && with non-matching expressions.

When using the filter builder, you will notice that as the filter is constructed, it is entered into the filter bar. It is also possible to directly type into the filter bar. See Advanced use of filters for more information on the format of filters. For a list of the available items to filter on, and their meanings, see Terms available for use in filters.

This section contains information on using JavaScript to construct custom filters, which allows very specific filtering.

Basic use of filters describes the basic use of filters. To use a filter, an expression is entered into the filter bar, which specifies what to filter on. The filter expression is actually interpreted in JavaScript, which allows the full power of JavaScript to be used to create a filter. The expression can take the form of a series of JavaScript statements, eg:

Each of these statements is evaluated for each network traffic datapoint found. The result used by the filter is the result of the final statement, statement-n, which must be a boolean. If the result is true, then the datapoint is passed by the filter, and added to the chart. If the result is false, then that datapoint is discarded. If the final expression is not a boolean, then an error is indicated. Note that the statements prior to the final one may have side effects, that affect the result of the final statement.

The terms that can be referenced from the filter are listed in Terms available for use in filters. Any valid JavaScript boolean operator or function can be used to evaluate a term. This includes regular expressions, which allow more complex pattern matching than equality.

A common requirement, but one difficult to formulate in a filter, is testing if an IP address is a member of a specific subnet. To make this easier, a function is provided for this purpose: inSubnet(address, subnet, maskBits). This will return true if address is a member of subnet with a mask of length maskBits. address can be any address field, or in fact any string representing an IP address.

For example, to create a filter to retain only traffic from subnet 10.1.2.0/24, use this filter:

More complex filters can be constructed; for example, if you wanted all traffic from the above subnet going to another subnet 192.168.0.0/16, then you could use:

Similarly to inSubnet, an address can be tested for falling within a range of IP addresses, but where the range may not form a valid subnet. For this, use the function inIPRange(address, rangeStart, rangeEnd). This will return true if address is greater than or equal to rangeStart and less than or equal to rangeEnd. rangeStart and rangeEnd can be either IPv4 or IPv6 addresses (both must be of the same version).

For example, to create a filter to retain only traffic sourced from 10.1.2.1 to 10.1.2.10, use the filter:

Database fields reference describes the fields that can be used in filters. These fields must be formed into filter expressions, as described in Advanced use of filters. The table also specifies the type of each field. You should be careful to only combine fields of the correct type together, using the normal rules for JavaScript.

As noted in Database fields reference, only fields that are associated with the database table (flows or counters) that the query is being run over can be used.

In addition to constant fields, functions are also provided to help build filters. The functions available are described in Filter functions reference

Selecting   User preferences brings up the user preferences dialog. This allows you to change the settings for the current user. If you have created users in sFlowTrend-Pro (see Configuring user authentication ), then changing the user preferences will apply for the current user wherever they are logged in from. If you have not created any users, then the new user preferences will apply globally.

Selecting   System configuration allows several system-wide settings to be configured. The system configuration option will only be available if you are logged in as an administrator.

An sFlow agent is responsible for sending sFlow data to sFlowTrend-Pro from a switch (or router) or a host. In the case of a switch or router, one agent will be associated with the device, and the IP address of the agent will normally be the same (or one of the) IP address used for the switch. Switches can be configured to send sFlow from sFlowTrend-Pro using SNMP, or alternatively the switch can be manually configured. For hosts, normally the agent runs on a physical host. This agent can send data for both that host, and any virtual machines that are running on that host. Hosts are configured to send sFlow either through DNS or manually.

Select the   Configure agents menu item to launch the Configure agents dialog. This dialog contains a table which lists all the agents that sFlowTrend-Pro is receiving sFlow from. For switches, it also allows you to change the SNMP settings for each switch, and to tell sFlowTrend-Pro about switches that it should configure via SNMP to send sFlow.

The table includes the following columns:

Any changes made to agents and their settings will not be implemented until the OK button is clicked.

You can control which users have access to sFlowTrend-Pro by using the user authentication feature of sFlowTrend-Pro. User authentication is configured via the   Manage users menu item, which launches the Manage users dialog. This dialog contains a table which lists all the configured users and allows you to add users, change the password and role for a user, and delete users.

By default, there are no users configured in sFlowTrend-Pro and user authentication is disabled. This means that any user can use sFlowTrend-Pro and will have all the permissions associated with the Administrator role.

Once you have added at least one user, user authentication is enabled and any user wishing to connect to sFlowTrend-Pro must login with a configured user login name and password.

Select the   Configure subnets menu item to launch the Configure subnets dialog. This dialog allows you to tell sFlowTrend-Pro about how end host IP addresses should be grouped together. Grouping end host addresses allows you to understand traffic patterns better. For example, identifying end host addresses for each department, allows you to view traffic between departments; understanding network traffic in this way, allows you to make accurate capacity planning decisions and help enforce usage policies.

sFlowTrend-Pro uses Classless Inter-domain Routing (CIDR) as the method to define groups of addresses. In CIDR notation a group of IP addresses is defined using a network (IP) address and a number of mask bits indicating the number of significant bits from the address that will be shared by members of the group. For example, the CIDR 10.1.4.0/24 will group all the addresses that share the 10.1.4 prefix; ie all the addresses that exist on the 10.1.4.0/255.255.255.0 subnet. sFlowTrend-Pro supports the CIDR notation for grouping IPv4 and IPv6 addresses.

To illustrate CIDR priorities, consider the an IP address, 10.1.4.1. Suppose that two CIDRs are defined, 10.1.4.0/24 and 10.0.0.0/8. The IP address is contained in both of these CIDRs, but the CIDR 10.1.4.0/24 is a more specific group of addresses and so will have priority over the 10.0.0.0/8 CIDR.

CIDRs provide a very efficient means of specifying address groups. The goal is not to reflect every detailed subnet in the network, but to use CIDRs to describe the overall subnetting policy for the site.

The following example gives a typical subnet configuration:

In this example we have added a special subnet for Multicast. We have also added a "catch all" subnet, called "Unassigned". Remember that an address will be assigned to the most specific CIDR, so the only addresses that will be shown in the Unassigned subnet will be local addresses that don’t belong in any of the other subnets. Configuring a "catch all" subnet in this way, allows you to distinguish between internal and external addresses.

Configure subnets dialog allows you to add new subnets and edit and delete existing subnets. To edit an existing subnet, click on the edit symbol, , for the row representing the subnet. To delete an existing subnet, click on the delete symbol, , for the row representing the subnet. The dialog will prevent you from adding or editing subnets if the add or edit would result in duplicate names or CIDRs.

Select the   Configure events menu item to launch the Configure events dialog. This dialog allows you to configure automatic actions when sFlowTrend-Pro raises an event.

The Edit action on event dialog allows you to add new actions by clicking on the Add action button and edit an existing action, by clicking on the edit symbol, . When you add or edit an action the Edit action on event dialog is displayed.

This dialog allows you to specify a specific action when certain event criteria are met.

To configure the event criteria, first select an event Type. You can select All, Threshold, System or Scheduled report event types. Once you have selected an event type, you can then select other criteria specific to that type. For all event types, you can select the event Severity when an action will be performed. For the Threshold event type you can select additional event criteria, specific to threshold events. Similarly, for Scheduled report events there are specific criteria that you can select.

To configure the action to be taken when event criteria are met, select an Action type. When you select the Email action, events meeting the criteria will be sent in an email to the Recipients that you specify. You can specify a number of email recipients by entering a comma separated list of email addresses. For sFlowTrend-Pro to be able to send events via email, you must first configure the email SMTP server (see Email). When you select the Syslog action, events meeting the criteria will be exported to the specified syslog server using the specified UDP Port to connect to the syslog server and the specified Facility to indicate the source of the event. sFlowTrend-Pro uses the event severity as the syslog message priority severity level indicator. See https://tools.ietf.org/html/rfc3164 for more information on syslog.

If sFlowTrend-Pro generates a large number of events, this will cause a large number of actions with matching criteria to be run. This may be inconvenient: for example, if a network suddenly became very busy, and you have an email action enabled for threshold events on all interfaces, then you would receive a very large number of email messages (one per interface exceeding the threshold). To minimize this, it is recommended that you configure event actions carefully, only selecting event criteria that are important to you. sFlowTrend-Pro will also try to minimize event action storms. If more than a predefined number of actions are queued for processing (eg email messages queued to be sent), then further actions of that type will be suppressed. An additional event will be logged informing you that event action suppression has taken place. Once the pending actions are processed, then new ones will again be accepted. This suppression threshold can be configured (see server custom configuration settings [advanced.configuration.event.emailThreshold] and [advanced.configuration.event.syslogThreshold]).

If you have enabled client notifications, and the system you are running sFlowTrend-Pro on has Internet connectivity, then you should receive a notification when a new version of sFlowTrend-Pro is available. You can also check manually for updates using the   Check for updates menu item.

This page contains answers to some frequently asked questions when running sFlowTrend-Pro.

Some custom sFlowTrend-Pro server configuration is possible through the sFlowTrend-Pro properties file. Modifying this is only recommended for advanced users. The file must be edited using a standard text editor, and sFlowTrend-Pro service must be restarted before any of the changes will take effect. Changes to the configuration will affect all users using the server.

The properties file is called config.prp, and it is located in the sFlowTrend-Pro home directory (which can be identified through the sFlowTrend-Pro   System configuration menu, General tab, File location).

If the config.prp file does not exist in the directory, then create the file first. The file is organized as a series of lines, where each line is of the form:

For example,

would change the number of hours of data stored in the database to 336 (2 weeks). Note that all properties and values must be entered exactly as specified. Some of the properties that can be modified using the properties file are:

sFlowTrend-Pro comes with a built-in mapping from protocol numbers (eg TCP and UDP port) to names, to make charts and reports easier to understand. If you have any site-specific protocols that you would like to add, so that they show with the correct name for your network, then this can achieved by adding a protocol definitions file.

First, create a file called protocols.txt in the sFlowTrend-Pro server home directory (you can find this from the   System configuration menu, General tab, File location). Make sure that you create the file on the server running the sFlowTrend-Pro service. Then add to the file the definitions required. The format of the file must be

Each [Section] provides definitions for a specific type of protocol number. The sections that are currently allowed are show in Protocol definition sections. Following the section definition, any number of definition lines can be entered. The definition lines start with the protocol number (in decimal), or optionally a range of numbers, followed by a comma then the name of the protocol. This can be optionally followed by an extended name, which is currently not used in sFlowTrend-Pro, but could be in the future.

Protocol definition sections shows the sections than can be used, and provides an example of a definition line that might be in each section. Once you have created the file with the definitions that you require, or if you edit the file, the sFlowTrend-Pro service must be restarted for the change to take effect.

For example, this is an excerpt from the standard mapping that is included with sFlowTrend-Pro:

It is possible to customize the appearance of the web client for individual users using CSS. To do this, first locate the users directory in the sFlowTrend-Pro server home directory (which can be identified through the   System configuration menu, General tab, File location). Within the users directory there will be a subdirectory for each configured user, or, if you have not configured users, there will be one subdirectory named anonymous.user. In the user directory, create a CSS file user.css. Edit this file to include custom styling for the user. The elements and classes to apply styles to can be identified using a Web Developer, Inspector tool. The user must refresh the sFlowTrend-Pro web page for any changes to take effect.

sFlowTrend-Pro supports a RESTful API that allows flexible, programmatic access to stored data. For more details, open a support request at the InMon Corp. customer portal (https://www.myinmon.com) or send an email to sflowtrend@inmon.com.

This section contains a reference for each of the menu selections in sFlowTrend-Pro.

This section contains a reference for each of the database fields. There are used in JavaScript filters, and in the select and sort statements in advanced reports.

Depending on which database table a query is being run over, different fields are available. The tables available are:

The fields available are keys, values or time. Keys represent aspects of the traffic being analyzed (eg a source address), while values are associated with that traffic (eg frames transmitted). Value fields can be used in a database sort statement, to sort the column in the resulting table (note that the same field must be in the select statement before it can be used in the sort statement). Additionally, there is one time field, which represents the time when traffic was observed.

The fields below are organized by database table, and by key, value and time.