I have a request to use NTA to monitor a nightly SFTP job that runs at 4am and typically transfers ~60M of data.
The desired outcome of the alert would be to notify if that job didn't produce a minimal flow of data during that 4am window.
When I navigate to the actual SFTP conversation in NTA and hit "Create a flow alert" I cannot use the "Create Alert" button because of this error:
For traffic matching the current Flow Navigator filters:
There is no Application or NBAR2 Application selected in Flow Navigator
If I drill down on the top 10 protocols for that conversation I get to the firewall/interface, then click on the application so I can create an alert but it's just for the app on that firewall interface - no filtering on client/server conversation
For traffic matching the current Flow Navigator filters:
Included Application: SSH / SFTP (22)
Here is what this alert looks like after creating it:
LEFT JOIN
(
SELECT InterfaceID
FROM Orion.Netflow.FlowsByInterface
WHERE
(TimeStamp >= AddMinute(-6, DateTrunc('minute', GetUtcDate())) AND TimeStamp <= AddMinute(-2, DateTrunc('minute', GetUtcDate())))
AND InterfaceID IN (19174)
AND (ApplicationID IN (100016) AND ApplicationID != 0)
GROUP BY InterfaceID
HAVING NOT ((SUM(IngressBytes)*8) / (5*60)) <= 10000
) AS Flows
ON Flows.InterfaceID = Interfaces.InterfaceID
WHERE Interfaces.InterfaceID IN (19174)
AND Flows.InterfaceID IS NULL
AND Interfaces.InterfaceID NOT IN (
SELECT EntityID FROM Orion.NetObjectDownTime
WHERE EntityType = 'Orion.NPM.Interfaces'
AND DateTimeUntilNow > AddMinute(-7, DateTrunc('minute', GetUtcDate()))
AND State = 9
AND EntityID IN (19174)
)
AND Interfaces.InterfaceID IN (
SELECT InterfaceID FROM Orion.Netflow.Source
WHERE Enabled = 'True'
AND (
EngineID IS NULL OR
EngineID NOT IN (
SELECT EngineID FROM Orion.Netflow.FlowEngines
WHERE FlowCollectorKeepAlive < AddSecond(-90, GETUTCDATE()) OR
AddMinute(7, FlowCollectorStartTime) > GETUTCDATE()
)
)
)
Is there anyway to augment this or write differently to capture the 2 end nodes conversation specifically?
