1<!DOCTYPE refentry PUBLIC "-//Davenport//DTD DocBook V3.0//EN">
2<refentry>
3
4<refmeta>
5<refentrytitle>
6<application>flow-rpt2rrd</application>
7</refentrytitle>
8<manvolnum>1</manvolnum>
9</refmeta>
10
11<refnamediv>
12<refname>
13<application>flow-rpt2rrd</application>
14</refname>
15<refpurpose>
16Convert flow-report CSV output to RRDtool format.
17</refpurpose>
18</refnamediv>
19
20<refsynopsisdiv>
21<cmdsynopsis>
22<command>flow-rpt2rrd</command>
23<arg>-nv</arg>
24<arg>-d<replaceable> debug_level</replaceable></arg>
25<arg>-k<replaceable> keys</replaceable></arg>
26<arg>-K<replaceable> keys_file</replaceable></arg>
27<arg>-f<replaceable> fields</replaceable></arg>
28<arg>-p<replaceable> rrd_path</replaceable></arg>
29<arg>-P<replaceable> rrd_postfix</replaceable></arg>
30<arg>-r<replaceable> rrd_storage</replaceable></arg>
31</cmdsynopsis>
32</refsynopsisdiv>
33
34<refsect1>
35<title>DESCRIPTION</title>
36<para>
37The <command>flow-rpt2rrd</command> utility processes the CSV output of
38flow-report into RRDtool format.  The aggregates for a key are each
39stored as a DS in RRD filename {rrd_path,"/",key,rrd_postfix,".rrd"}.
40By default a DS is created for flows, octets, and packets.  The key
41must be specified, for example an ip-port report could use smtp,nntp,ssh,telnet
42as the keys which would create a separate RRD for each key.
43</para>
44</refsect1>
45
46<refsect1>
47<title>OPTIONS</title>
48<variablelist>
49
50<varlistentry>
51<term>-d<replaceable> debug_level</replaceable></term>
52<listitem>
53<para>
54Set debug level to debug_level (debugging code)
55</para>
56</listitem>
57</varlistentry>
58
59<varlistentry>
60<term>-h</term>
61<listitem>
62<para>
63Help.
64</para>
65</listitem>
66</varlistentry>
67
68<varlistentry>
69<term>-k<replaceable> keys</replaceable>|<replaceable>html</replaceable</term>
70<listitem>
71<para>
72Comma separated list of key values.  If the report has symbols
73then the key must be the symbol, ie smtp not 25.  The totals_* lines
74may be used if they are enabled in the report.  There is no default,
75keys must be specified with -k or -K.
76</para>
77</listitem>
78</varlistentry>
79
80<varlistentry>
81<term>-K<replaceable> keys_file</replaceable></term>
82<listitem>
83<para>
84Load keys from <replaceable>keys_file</replaceable>.  See -k.
85</para>
86</listitem>
87</varlistentry>
88
89<varlistentry>
90<term>-f</term>
91<listitem>
92<para>
93Comma separated list of columns to store.  Each column maps to a DS in the
94RRD.  Defaults to flows,octets,packets
95</para>
96</listitem>
97</varlistentry>
98
99<varlistentry>
100<term>-n</term>
101<listitem>
102<para>
103Enable symbol table lookups.  For example TCP port 25 = smtp.  This will
104result in RRD file names with the symbolic names if symbol lookups were
105not enabled in the report.
106</para>
107</listitem>
108</varlistentry>
109
110<varlistentry>
111 <term>-p<replaceable> rrd_path</replaceable></term>
112<listitem>
113<para>
114Set path to RRD files.  Defaults to ".".
115</para>
116</listitem>
117</varlistentry>
118
119<varlistentry>
120<term>-P<replaceable> rrd_postfix</replaceable></term>
121<listitem>
122<para>
123Set RRD file name postfix.  Defaults to "".
124</para>
125</listitem>
126</varlistentry>
127
128<varlistentry>
129<term>-r<replaceable> rrd_storage</replaceable></term>
130<listitem>
131<para>
132Set RRD storage for 5 minute, 30 minute, 2 hour, and 1 day databases.  List
133items are : seperated.  Defaults to 600:600:600:732.
134</para>
135</listitem>
136</varlistentry>
137
138<varlistentry>
139<term>-v</term>
140<listitem>
141<para>
142Enable verbose output.
143</para>
144</listitem>
145</varlistentry>
146
147</variablelist>
148</refsect1>
149
150<refsect1>
151<title>EXAMPLES</title>
152<informalexample>
153<screen>
154The following example shows the combined use of flow-nfilter (inline),
155flow-report, and flow-rpt2rrd to create an RRD depicting traffic
156from clmbo-r4 to AS 10796 and 6478 for 2004-11-08.  rrdtool graph is
157then used to create a .png.
158
159#!/bin/sh
160
161cat &lt&lt EOF>report.cfg
162
163include-filter nfilter.cfg
164
165stat-report CLMBO-R4-TO-INTERNET-BY-DESTINATION-AS
166  type destination-as
167  filter CLMBO-R4-INTERNET-OUT
168  scale 100
169  output
170    options +header,+xheader
171    fields -duration
172
173stat-definition 5min-summaries
174  report CLMBO-R4-TO-INTERNET-BY-DESTINATION-AS
175EOF
176
177cat &lt&lt EOF>nfilter.cfg
178# ifMIB.ifMIBObjects.ifXTable.ifXEntry.ifName.46 = so-0/0/0.0
179filter-primitive CLMBO-R4-INTERNET
180  type ifindex
181  permit 46
182
183# Match on traffic to the Internet
184filter-definition CLMBO-R4-INTERNET-OUT
185  match output-interface CLMBO-R4-INTERNET
186EOF
187
188mkdir rrds
189
190# 5 minute flow files from flow-capture are here
191FLOW_DATA=/flows/clmbo-r4/2004-11-08/
192
193# for each 5 minute flow,aggregate with flow-report then store to RRD
194for name in $FLOW_DATA/*; do
195  echo working...$name
196  flow-report -s report.cfg -S5min-summaries < $name | flow-rpt2rrd -k10796,6478  -p rrds
197done
198
199# first flow - 0:1:23 11/8/2004
200START=1099890083
201# last flow - 0:1:25 11/9/2004
202END=1099976485
203
204rrdtool graph CLMBO-R4-TO-INTERNET.png --start $START --end $END \
205        --vertical-label "Bits/Second" --title="CLMBO-R4 TO INTERNET BY AS" \
206        DEF:AS10796in=rrds/10796.rrd:octets:AVERAGE \
207        DEF:AS6478in=rrds/6478.rrd:octets:AVERAGE \
208        CDEF:b_AS10796in=AS10796in,8,* \
209        CDEF:b_AS6478in=AS6478in,8,* \
210        LINE1:b_AS10796in#FF0000:AS10796-in \
211        LINE1:b_AS6478in#555555:AS6478-in \
212
213</screen>
214</informalexample>
215
216</refsect1>
217
218
219<refsect1>
220<title>BUGS</title>
221<para>
222Hard coded to expect 5 minute flow file intervals.  Does not properly parse
223flow-report time-series output.
224</para>
225</refsect1>
226
227<refsect1>
228<title>AUTHOR</title>
229<para>
230<author>
231<firstname>Mark</firstname>
232<surname>Fullmer</surname>
233</author>
234<email>maf@splintered.net</email>
235</para>
236</refsect1>
237
238<refsect1>
239<title>SEE ALSO</title>
240<para>
241<application>flow-tools</application>(1)
242</para>
243</refsect1>
244
245</refentry>
246