I'm looking for a report showing me the top 10 NetFlow sources by the number of flows. I can see total flows per engine over time but need more detail to troubleshoot who is sending the most flows and ensure their config is setup correctly.
The Netflow settings table will show you the number of flows/sec received. We need to identify what is sending the most flows/sec.
This query will show what polling engine is receiving the number of flows/second.
SELECT
e.ServerName AS [Polling Engine Name]
, a5m.StatisticsValue AS [Avg 5 Minute Flows/sec]
, a24h.StatisticsValue AS [Avg 24 Hour Flows/sec]
, a3d.StatisticsValue AS [Avg 3 Day Flows/sec]
FROM Orion.Engines e
left JOIN (SELECT EngineID, StatisticsName, StatisticsValue
FROM Orion.Netflow.NetFlowEnginesStatistics
WHERE StatisticsName = 'FlowsPerSecondForLast24Hours') a24h
ON a24h.EngineID = e.EngineID
left JOIN (SELECT EngineID, StatisticsName, StatisticsValue
FROM Orion.Netflow.NetFlowEnginesStatistics
WHERE StatisticsName = 'FlowsPerSecondForLast3Days') a3d
ON a3d.EngineID = e.EngineID
left JOIN (SELECT EngineID, StatisticsName, StatisticsValue
FROM Orion.Netflow.NetFlowEnginesStatistics
WHERE StatisticsName = 'FlowsPerSecondForLast5Minutes') a5m
ON a5m.EngineID = e.EngineID
WHERE e.ServerType != 'RemoteCollector'
ORDER BY a5m.StatisticsValue DESC
My question is how can I identity the device that is sending the most total flows/second to each poller, a report of top 10 Netfow Sources would help.
