Operational Status Report
You can get to this from "Views -> Operational Status Report"
High Volume mode sample:
To read a loadCycle: "Load Time: 42.73s, Insertion Time: 21.08s, Filter Time: 0.15s, Endpoint Time: 10.41s, Flows: 56075, Conversations: 21246, Skipped Filtered Flows: 53, Unique IPs: 8960"
total processing time = "Load Time + Filter Time + Endpoint Time" (Load time includes Insertion Time, it is broken out to help see DB performance)
total processing time = 42.73 + 0.15 + 10.41
total processing time = 53.29s
| Date | Activity | Type | Status | Details | Stats |
|---|---|---|---|---|---|
| 2016-04-19T11:12:13 | loadCycle | completed | ok | Process 27739 done with file(s) nfcapd.201604191109 | Load Time: 42.73s, Insertion Time: 21.08s, Filter Time: 0.15s, Endpoint Time: 10.41s, Flows: 56075, Conversations: 21246, Skipped Filtered Flows: 53, Unique IPs: 8960 |
| 2016-04-19T11:10:02 | loadCycle | completed | ok | Process 27684 done with file(s) nfcapd.201604191107 | Load Time: 37.42s, Insertion Time: 18.82s, Filter Time: 0.13s, Endpoint Time: 5.37s, Flows: 48445, Conversations: 18372, Skipped Filtered Flows: 57, Unique IPs: 8472 |
| 2016-04-19T11:08:30 | loadCycle | completed | ok | Process 27576 done with file(s) nfcapd.201604191105 | Load Time: 55.97s, Insertion Time: 33.9s, Filter Time: 0.24s, Endpoint Time: 10.17s, Flows: 56434, Conversations: 21374, Skipped Filtered Flows: 51, Unique IPs: 8788 |
| 2016-04-19T11:06:28 | loadCycle | completed | ok | Process 27438 done with file(s) nfcapd.201604191103 | Load Time: 54.56s, Insertion Time: 34.03s, Filter Time: 0.14s, Endpoint Time: 10.56s, Flows: 55158, Conversations: 19285, Skipped Filtered Flows: 45, Unique IPs: 8975 |
Low Volume mode example:
To read a loadCycle: "Load Time: 223.72s Summarize Time: 5.05s Aggregation Time: 3.18s Filter Time: 133.78s Endpoint Time: 23.65s Flows: 202482 Conversations: 16355 Unique IPs: 5221" the
total processing time = "Load Time + Summarize Time + Filter Time + Endpoint Time" ( Summarise Time includes Aggregation Time, it is broken out to see DB performance)
total processing time = 223.72 + 5.05 + 133.78 + 23.65
total processing time = 386.2s
Low Volume mode does not list the insertion time
Also note:
Skipped Empty Flows - flows that were skipped because they had 0 bytes
Skipped Filtered Flows - flows that were skipped because they matched the config setting opflow_drop_endpoints
opflow-cli.pl - Manage opFlow from the CLI
opflow-cli.pl allows you to run setup routines, create reports, manually load flow files and generally run CRUD operations on endpoints/apps/agents/filters.
Run opflow-cli.pl -h to get help:
Usage: opflow-cli.pl act=operation [option=A...] [param=X...] opflow-cli.pl act=setup-db [drop=true] [usepercent=NN] opflow-cli.pl act=setup-iana [url=...|file=...] opflow-cli.pl act=(purge|purge-raw|purge-endpoints|purge-indices) opflow-cli.pl act=load-flows file=... opflow-cli.pl act=list-endpoints [searchprop=value...] value can be regex:... opflow-cli.pl act=create-endpoint property=value... opflow-cli.pl act=show-endpoint ip=address opflow-cli.pl act=update-endpoint ip=address entry.propname=value... opflow-cli.pl act=delete-endpoint ip=address opflow-cli.pl act=list-apps [searchprop=value...] opflow-cli.pl act=(create-app|update-app) number=N protocol=M name=X description=Y opflow-cli.pl act=delete-app number=N protocol=M opflow-cli.pl act=list-agents opflow-cli.pl act=update-agent agent=X [in_if=Y out_if=Z] admin_status=(active|inactive) opflow-cli.pl act=list-filters [include_inactive=0/1] opflow-cli.pl act=show-filter name=F opflow-cli.pl act=disable-filter name=F opflow-cli.pl act=create-filter name=F [description=D] propA=X,Y,Z [propB=...] properties: agent application endpoint proto src_ip dst_ip src_port dst_port filter expressions: A,B,C for list of choices, regex:string supported for all properties except agent and proto. proto must be number or list of numbers. agent must be agent_ip (for all interfaces), or agent_ip:in_ifidx:out_ifidx. opflow-cli.pl act=create-report [param=...] options: quiet=1: suppress output, only set exit code debug=1: more verbose debugging output
Manage Agents
Agents and the interfaces seen on those agents can be viewed, set inactive or set active. A "wildcard" agent record can be seen for each agent IP that opFlow has received flows from, setting the active/inactive flag on this record disable all flows coming form this agent. In addition to this, an entry for each agent+in_if+out_if combo is also stored which allows disabling flows from specific interfaces and directions.
Note: Disabling all flows in+out of an interface will remove it from the licensing count (lowering the used count by one interface). opFlow 3.0.2 requires each combo to be disabled, just disabling the wildcard record will not remove the interfaces from the licensing count.
Get a list of Agents
/usr/local/omk/bin/opflow-cli.pl act=list-agents
e.g.
[root@server:/usr/local/omk/bin]#(2) ./opflow-cli.pl act=list-agents opflow-cli.pl Version 3.1.0 Copyright (C) 2015 Opmantek Limited (www.opmantek.com) This program comes with ABSOLUTELY NO WARRANTY; See www.opmantek.com or email contact@opmantek.com opFlow 1.0 is licensed to Opmantek for 50 Interfaces Agent IP In Intf Out Intf Active Last Seen 120.29.0.102 2 1 active Tue Apr 19 13:53:57 2016 120.29.0.102 1 2 active Tue Apr 19 13:53:57 2016 120.29.0.102 1 0 active Tue Apr 19 13:53:57 2016 120.29.0.102 * * active Tue Apr 19 13:53:57 2016 192.168.88.254 8 1 active Tue Apr 19 13:40:01 2016 192.168.88.254 2 1 active Tue Apr 19 13:53:57 2016 192.168.88.254 10 1 active Tue Apr 19 13:53:57 2016 192.168.88.254 1 8 active Tue Apr 19 13:40:01 2016
Stop Processing Flows from an Agent/Interface
To disable processing flows from an agent, disable all agent+in_if+out_if entries. Here is an example of disabling a single agent interface:
# disable a whole agent /usr/local/omk/bin/opflow-cli.pl act=update-agent agent=120.29.0.102 admin_status=inactive # disable an interface: in both directions to remove a single interface /usr/local/omk/bin/opflow-cli.pl act=update-agent agent=120.29.0.102 in_if=2 out_if=1 admin_status=inactive /usr/local/omk/bin/opflow-cli.pl act=update-agent agent=120.29.0.102 in_if=1 out_if=2 admin_status=inactive
Start Processing Flows from an Agent/Interface
Note: Enabling an agent which has individual interface records disabled will not enable those interface records as well.
# enable a whole agent, /usr/local/omk/bin/opflow-cli.pl act=update-agent agent=120.29.0.102 admin_status=inactive # enable flows in both directions to add a single interface back, only a single direction can be enabled if desired /usr/local/omk/bin/opflow-cli.pl act=update-agent agent=120.29.0.102 in_if=2 out_if=1 admin_status=active /usr/local/omk/bin/opflow-cli.pl act=update-agent agent=120.29.0.102 in_if=1 out_if=2 admin_status=active
Manage Filters
Filters allow you to create pre-defined searches that will load quickly in the GUI. A filter must be in place before the flows arrive as the flows are tagged with the filter when they are processed. Any flows that match the filter but arrived before the filter was created will not be displayed.
Note: Agents are filtered automatically, there is no need to create extra filters for them.
Options for filtering rules: agent|application|endpoint|proto|src_ip|dst_ip|src_port|dst_port
Create a Filter Based on Application
/usr/local/omk/bin/opflow-cli.pl act=create-filter name=HTTP application=http /usr/local/omk/bin/opflow-cli.pl act=create-filter name=HTTPS application=https