7 Replies Latest reply on May 19, 2016 3:38 PM by dclick

    netflow and samplicator

    dclick

      I understand that SolarWinds cant provide support for Samplicator - so I am asking the community at large.

       

      I have just installed samplicator, and though I am getting Netflow from the samplicator server to my NTA, its not spoofing the IP address - everything is showing up as coming from the samplicator server.  Here is my command line -

       

      /usr/local/bin/samplicate -S -f -s0.0.0.0 -p2055 <orion_NPM_ip>/2055.

       

      I have about 15 (cisco) routers sending the the "NMS-2" (samplicator) server..

       

       

      any thoughts?

        • Re: netflow and samplicator
          Craig Norborg

          Are you running it as root?

           

          I believe most, if not all, Cisco devices support multiple collectors being configured on their own...

          • Re: netflow and samplicator
            dclick

            Yes, I am running as root.  I am attempting to simplify our configurations - one syslog entry, one netflow entry. replicating the data from there makes life much easier, for us.

              • Re: netflow and samplicator
                Craig Norborg

                It also adds one more single point of failure.  Not a fan of that concept.  I would only use something like the samplicator when I needed to, either had a netflow source that wouldn't send to multiple collectors if I needed it, or maybe use it as a proxy for a netflow source that didn't have direct access to the collector.   A couple lines in a configuration are more reliable than another box forwarding the messages for you.

                 

                At a previous job someone had set up a pair of high-end syslog collectors as a mirror of each-other.   Only one would receive syslog messages and it was set up to forward to the "backup".  This was on a top-secret network that had no outside connectivity.  One day someone noticed that the main collector had been down for several days.   Had we set it up with two different logging entries, it wouldn't have been a problem.  But with the way it was set up, with the primary box going down there was no way for the backup box to continue getting the syslogs so we lost out on several days worth of potentially important information.

                 

                Similar setup to what you're describing.  What will you do if this intermediate box fails?  Will you be ok with losing data for that time period on both of your collectors?

              • Re: netflow and samplicator
                dclick

                I have it running, and love it. So easy to do..

                 

                I think I ended up upgrading my packages - and make sure is "-S" (case is very important.)

                cant remember doing anything else,.