xenial (1) flow-capture.1.gz

Provided by: flow-tools_0.68-12.3build2_amd64 bug

flow-capture(1)                              General Commands Manual                             flow-capture(1)

NAME

       flow-capture — Manage storage of flow file archives by expiring old data.

SYNOPSIS

       flow-capture  [-hu]   [-b  big|little]  [-C comment]  [-c flow_clients]  [-d debug_level]  [-D daemonize]
       [-e expire_count]  [-f filter_fname]  [-F  filter_definition]   [-E  expire_size]   [-n  rotations]   [-N
       nesting_level]    [-p   pidfile]    [-R   rotate_program]    [-S   stat_interval]   [-t  tag_fname]   [-T
       active_def|active_def,active_def ...]  [-V pdu_version]  [-z z_level] -w workdir  [-x  xlate_fname]   [-X
       xlate_definition] localip/remoteip/port

DESCRIPTION

       The  flow-capture  utility  will  receive  and store NetFlow exports to disk.  The flow files are rotated
       rotationstimes per day and expiration of old flow files can be configured by number  of  files  or  total
       space  utilization.   Files  are  stored  in workdir and can optionally be stored in additional levels of
       directories.  Active files created by flow-capture begin with 'tmp'.  Files that are complete begin  with
       'ft'.

       When  the remoteip is configured only flows from that exporter will be processed, this is the most secure
       and recommended configuration.  When the localip is configured flow-capture will only process flows  sent
       to  the   localip  IP  address.   If  remoteip is 0 (not configured) flows from any source IP address are
       accepted.  Multiple non aggregated PDU versions may be accepted at once to support Cisco's Catalyst  6500
       NetFlow  implementation which exports from both the supervisor and MSFC with the same IP address and same
       port but different export versions.  In this case the exports will be stored in the format  specified  by
       pdu_version or whichever export type is received first.

       NetFlow  exports  are  UDP  and  do  not employ congestion control or a retransmission mechanism.  If the
       server flow-capture is configured on is too busy, or the network is congested or  lossy  NetFlow  exports
       will  be  lost.   An  estimate  of lost flows is recorded in the flow files, and logged via syslog.  Most
       servers will provide a count of dropped packets due to full socket buffers via the netstat utility.   For
       example  netstat  -s  | grep full will provide a count of UDP packets dropped due to full socket buffers.
       If this is a persistent occurrence either flow-capture will need a larger server or the compression level
       should be decreased with -z.

       A SIGHUP signal will cause flow-capture to close the current file and create a new one.

       A SIGQUIT or SIGTERM signal will cause flow-capture to close the current file and exit.

OPTIONS

       -b big|little
                 Byte order of output.

       -c flow_clients
                 Enable flow_clients TCP clients.  When libwrap is available the client must be in a permit list
                 for the service flow-capture-client.

       -C Comment
                 Add a comment.

       -d debug_level
                 Enable debugging.

       -e expire_count
                 Retain the maximum number of files so that the total file  count  is  less  than  expire_count.
                 Defaults to 0 (do not expire).

       -E expire_size
                 Retain  the  maximum  number  of files so that the total storage is less than expire_size.  The
                 letters b,K,M,G can be used as multipliers, ie 16 Megabytes is  16M.   Default  to  0  (do  not
                 expire).

       -f filter_fname
                 Filter list filename.  Defaults to /etc/flow-tools/cfg/filter.

       -F filter_definition
                 Select the active definition.  Defaults to default.

       -h        Display help.

       -n rotations
                 Configure  the number of times flow-capture will create a new file per day.  The default is 95,
                 or every 15 minutes.

       -N nesting_level
                 Configure the nesting level for storing flow files.  The default is 0.
                    -3    YYYY/YYYY-MM/YYYY-MM-DD/flow-file
                    -2    YYYY-MM/YYYY-MM-DD/flow-file
                    -1    YYYY-MM-DD/flow-file
                     0    flow-file
                     1    YYYY/flow-file
                     2    YYYY/YYYY-MM/flow-file
                     3    YYYY/YYYY-MM/YYYY-MM-DD/flow-file

       -p pidfile
                 Configure the process ID file.  Use - to disable pid file creation.

       -R rotate_program
                 Execute rotate_program with the first argument as the flow file name after rotating it.

       -S stat_interval
                 When configured flow-capture  will  log  a  timestamped  message  every  stat_interval  minutes
                 indicating counters such as the number of flows received, packets processed, and lost flows.

       -t tag_fname
                 Load tags from tag_name

       -T active_def|active_def,active_def...
                 Use active_def as the active tag definition(s).

       -u        Preserve inherited umask.  By default the umask will be set to 0022.

       -V pdu_version
                 Use pdu_version format output.

           1    NetFlow version 1 (No sequence numbers, AS, or mask)
           5    NetFlow version 5
           6    NetFlow version 6 (5+ Encapsulation size)
           7    NetFlow version 7 (Catalyst switches)
           8.1  NetFlow AS Aggregation
           8.2  NetFlow Proto Port Aggregation
           8.3  NetFlow Source Prefix Aggregation
           8.4  NetFlow Destination Prefix Aggregation
           8.5  NetFlow Prefix Aggregation
           8.6  NetFlow Destination (Catalyst switches)
           8.7  NetFlow Source Destination (Catalyst switches)
           8.8  NetFlow Full Flow (Catalyst switches)
           8.9  NetFlow ToS AS Aggregation
           8.10 NetFlow ToS Proto Port Aggregation
           8.11 NetFlow ToS Source Prefix Aggregation
           8.12 NetFlow ToS Destination Prefix Aggregation
           8.13 NetFlow ToS Prefix Aggregation
           8.14 NetFlow ToS Prefix Port Aggregation
           1005 Flow-Tools tagged version 5

       -w workdir
                 Work in workdir.

       -x xlate_fname
                 Translation config file name.  Defaults to /etc/flow-tools/cfg/xlate.c fg

       -X xlate_definition
                 Translation definition.  Defaults to default.

       -z z_level
                 Configure  compression  level  to   z_level.   0  is  disabled  (no  compression), 9 is highest
                 compression.

EXAMPLES

       Receive flows from the  exporter  at  10.0.0.1  port  9800.   Maintain  5  Gigabytes  of  flow  files  in
       /flows/krc4.   Mask  the  source  and  destination  IP  addresses  contained  in  the  flow  exports with
       255.255.248.0.

         flow-capture -w /flows/krc4 -m 255.255.248.0 -E5G 0/10.0.0.1/9800

       Receive flows from any exporter on port 9800.  Do not perform any flow file space management.  Store  the
       exports in /flows/krc4.  Emit a stat log message every 5 minutes.

         flow-capture -w /flows/krc4 0/0/9800 -S5

BUGS

       Empty directories are not removed.

FILES

         Configuration files:
           Tag - /etc/flow-tools/cfg/tag.cfg.
           Filter - /etc/flow-tools/cfg/filter.cfg.
           Xlate - /etc/flow-tools/cfg/xlate.cfg.

AUTHOR

       Mark Fullmer maf@splintered.net

SEE ALSO

       flow-tools(1)

                                                                                                 flow-capture(1)