Before you begin
- NMIS installed on the same server that opFlow is being installed (NMIS version >=8.5.6G).
- The individual performing this installation has a small bit of Linux experience.
Root access is available.
- Internet access is required for installing any missing but required software packages.
- opFlow License (evaluation available here).
- If you do not yet have a working installation of NMIS in your server, please follow the procedure in the NMIS 8 Installation Guide.
- Download opFlow from the Opmantek website.
- If you have opFlow 2.X installed please see the upgrade documentation
Transfer the opCharts tarball onto the server in question, either by direct download from the Opmantek website, or from your desktop with
sftp or a similar file transfer tool.
Make a record of where you put the tarball (
root's home directory or /tmp are good locations).
Start the interactive installer and follow its instructions:
- The installer will interactively guide you through the steps of installing opFlow. Please make sure to read the on-screen prompts carefully.
- When the installer finishes, opFlow is installed into
/usr/local/omk, and the default configuration files are in
/usr/local/omk/conf, ready for your initial config adjustments.
- A detailed log of the installation process is saved as
/usr/local/omk/install.log, and subsequent upgrades or installations of other Opmantek products will add to that logfile.
- For detailed information about the interactive installer please check the Opmantek Installer page.
After installation you may need/want to change the directories that flows are stored in, the ports the flows are coming in on, etc. Please read the sections below for more.
nfdump uses, /etc/init.d/nfdump, e.g. service nfdump stop|stop|restart
To override configuation use /etc/sysconfig/nfdump (RH/CentOS) or /etc/default/nfdump (Debian/Ubuntu/etc).
This just needs to contain the changes you want, the init script (/etc/init.d/nfdump) has the following defaults.
So to change port and directory
Additional required steps If your OS is Debian or Ubuntu, and you are using systemd:
The most recent nfdump packages in Debian come with a problematic systemd service file (see bug Debian Bug 843602) which completely ignores /etc/default/nfdump.
Until that is resolved, we recommend that you disable the nfdump systemd service and have the system fall back to the properly working sysv init script, combined with the nfdump init script that was shipped with opFlow.
A symptom of that issue would be that
nfcapd is running with data directory
/var/cache/nfdump, is listening on a port that is neither 9995 nor your NETFLOW_PORT from /etc/default/nfdump, does not include the
"-T all" argument to enable netflow extensions, and does not include the
-t argument for data rotation.
The forced switch to SysV init script can be made by running the following commands as
root (ie. under
sudo bash or the like):
The following changes can be made in the opCommon config file /usr/local/omk/conf/opCommon.nmis
It is important that the <opflow_dir> in opCommon.nmis matches the DATA_BASE_DIR in the nfdump configuration
NMIS integration enables the resolution of Interface indexes to Interface Names. The association to an NMIS node enables opFlow to look up the interface indexes which the traffic is flowing to and from. Note the agents are a list of the IP addresses from which flows are received. The System -> Manage Agents function enables you to associate that agent IP with an actual node in NMIS. Associating to an NMIS node enables opFlow to look up the interface indexes which the traffic is flowing to and from. You MUST tell opFlow which IP address is which Node Name for this process to work
Linking with opCharts/NMIS can be done to an NMIS instance on the same server (Local) or can integrate to a remote instance of opCharts. The server (local or remote) must not be a master instance it must be a normal poller/slave instance.
Local NMIS integration
If the config setting 'opflow_opcharts_url_base' is left blank, opFlow will attempt to load node information from a local NMIS server found at 'nmis_dir' => '/usr/local/nmis8'
Remote NMIS/opCharts integration
Remote integration requires settting 3 config items, these are used so the opFlow server can access an opCharts server. When this is working the GUI will show ifDescr and Descriptions in the agent selector, and when filtering on an agent/interface will display the interface info panel.
The two servers must have the same value for <omk_url_base> (which is not often changed)
High volume settings
There are two high volume controls for opFlow, one for the backend and one for the frontend.
opflow_high_volume will cause opflowd to insert pre-aggregated flows if set, raw flows if not. Currently the GUI has no way of displaying raw flows so this is enabled by default.
opflow_gui_high_flow_volume will force the GUI to show a simplified/optimized index page, it can also be viewed by setting ?simple=1 on the index page, it is enabled by default.
Graph display settings
The graph that show flows over time can display 2 modes: the default shows the number of octets/packets in the current time slice, the second mode makes the graph display the data in octets/second or packets/second. To enable the second mode change the following config variable to 1:
Restart the daemons
After making changes to the config make sure to restart all opFlow daemons.
Configuring your Flow exporters
A basic router configuration guide for exporing flow data is available here.
opFlow attempts to resolve all ip address so DNS settings must be correct. Be sure to verify that DNS settings are appropriate: