Creating Netflow Reports

Hi,

We have enabled Netflow across our network. Hundreds of endpoints and it is rather onerous. I have tried to create reports but they look bad, require a lot of time trying to find the right variables, display them correctly, etc. Needless to say, I am not getting very far. And that's before the issue of duplicate data on ingress and egress.

Anyway, sorry for the rant. Quite simply, I was hoping to create a report that presents the data displayed after inputting the necessary criteria to the flow navigator. I can create an alert from this page but I'd like to set up a report to send periodically, rather than relying on a trigger. Is this possible?

I am getting the distinct impression that Solarwinds does not want people using it for reporting!

Find more posts tagged with

netflow report

nta

Accepted answers

mesverrum

The netflow UI has a lot of assumptions built in to try and save people from themselves, but if you don't know then you don't know. For one thing, displaying all traffic for a given netflow node is usually risky for the reason you mentioned, any traffic that comes in an interface is usually going out another interfaces so in order to over duplication you need to narrow your scope down to a specific interface, or a specific direction to eliminate that duplication. Those are the first few filters available in the flow navigator UI for a reason.

If you want to send a periodic netflow report I find the easiest solution to be to create the relevant filters, save the view to the menu bar, and then schedule a report that displays a web page instead of the more common style of reports and just paste in the URL for my Netflow view. There are other ways that get into increasing levels of complexity but this way is pretty painless for anyone who knows how to use the flow navigator.

All comments

mesverrum

ZakWooldridge

Thank you, I am still trying to get my head round the duplication. I have tried limiting the filters as much as possible but I think that Netflow has possibly been misconfigured as no matter what I do, it still shows that exactly 50pb are egressing and ingressing in the past 24 hours. Firstly, that figure is ridiculous, our infrastructure probably does 10tb at most in that time period and secondly, it's unlikely the figure is identical but I am still working on it.

As for your second suggestion, that is an ingenious workaround. Thank you, that's is really helpful. I wish I could give you more upvotes!

mesverrum

you that seems excessive, are you doing any kind of sampling or maybe sending flow from virtual sub interfaces in addition to the actual physical ports?

verwin_u

hi @ZakWooldridge

this is 2 things. reporting and duplicate data.

for reporting, its best faster if you utilize the flow navigator, save it and schedule it to via report manager

https://documentation.solarwinds.com/en/success_center/nta/content/nta-creating-custom-views-with-flow-navigator-sw1200.htm

https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-creating-a-new-web-based-report-sw1322.htm

for your duplicate data issue, you might need to review your device configuration. it better you monitor ingress or egress only.

https://documentation.solarwinds.com/en/success_center/nta/content/nta-chart-issues-sw1678.htm