with IBM Corp. · 2018-02-02 · – ZooKeeper Note: Because Zookeeper r equir es a majority , it...

IBM Network Performance Insight 1.2.2Document Revision R2E2

Network Performance InsightReferences

IBM

NoteBefore using this information and the product it supports, read the information in “Notices” on page 139.

This edition applies to version 1.2.2.0 of IBM Network Performance Insight and to all subsequent releases andmodifications until otherwise indicated in new editions.

© Copyright IBM Corporation 2015, 2018.US Government Users Restricted Rights – Use, duplication or disclosure restricted by GSA ADP Schedule Contractwith IBM Corp.

Contents

Reference . . . . . . . . . . . . . . vIntended audience . . . . . . . . . . . . vOrganization . . . . . . . . . . . . . . vNetwork Performance Insight architecture . . . . vService Management Connect . . . . . . . . ixNetwork Performance Insight technical training . . ixSupport information . . . . . . . . . . . ixConventions used in this publication . . . . . . ix

Typeface conventions . . . . . . . . . . x

Chapter 1. REST API definitions . . . . 1Flow APIs . . . . . . . . . . . . . . . 1

aggregation . . . . . . . . . . . . . 1interface . . . . . . . . . . . . . . 6qossummary . . . . . . . . . . . . . 10summary . . . . . . . . . . . . . . . 12threshold . . . . . . . . . . . . . . 19timeseries . . . . . . . . . . . . . 22

Metric APIs . . . . . . . . . . . . . . 27anomalies . . . . . . . . . . . . . . 27deviation . . . . . . . . . . . . . . 30entity . . . . . . . . . . . . . . . 36lastValue . . . . . . . . . . . . . . 39metrics . . . . . . . . . . . . . . . 43summary . . . . . . . . . . . . . . . 46timeseries . . . . . . . . . . . . . 53

Threshold API . . . . . . . . . . . . . 58definition . . . . . . . . . . . . . 58

Chapter 2. Command line interface . . 63basecamp-manager-cmd command reference . . . . 63backup command reference . . . . . . . . . 64restore command reference . . . . . . . . . 65

Chapter 3. NetFlow versions . . . . . 67NetFlow V1 formats . . . . . . . . . . . 67NetFlow V5 formats . . . . . . . . . . . 68V9 field type definitions . . . . . . . . . . 70Normalized Flow record fields in NetworkPerformance Insight . . . . . . . . . . . 76

Chapter 4. Dashboard reference . . . . 89Properties of the Network Performance Overviewdashboard . . . . . . . . . . . . . . . 89

Properties of the NetFlow dashboards . . . . . 90Properties of the On Demand Filtering dashboards 91

Chapter 5. SNMP formulas . . . . . . 95Supported Cisco IP SLA formulas . . . . . . . 95Supported Performance Metric OOTB DeviceSupport discovery agents . . . . . . . . . 101Supported Performance Metric OOTB DeviceSupport formulas . . . . . . . . . . . . 105

RFC MIB-II . . . . . . . . . . . . . 106Cisco . . . . . . . . . . . . . . . 112Juniper . . . . . . . . . . . . . . 116Huawei . . . . . . . . . . . . . . 117

Chapter 6. Configuring Flow devices 119Supported devices and flow formats. . . . . . 119Configuring NetFlow on Cisco routers . . . . . 119

Cisco IOS command modes . . . . . . . 120Configuring Flexible NetFlow and ApplicationVisibility and Control (AVC) . . . . . . . 121Enabling NetFlow on your devices . . . . . 125Configuring the Flow Exporters . . . . . . 125Customizing the number of entries in flowcache . . . . . . . . . . . . . . . 127Monitoring NetFlow information . . . . . . 127An example Cisco device configuration. . . . 128

Configuring flow on Juniper devices . . . . . 128Configuring J-Flow versions 5 and 8. . . . . 129Configuring J-Flow version 9 . . . . . . . 130Configuring J-Flow version 9 forSRX-DataCenter devices . . . . . . . . . 132Using the show commands . . . . . . . . 132

Configuring NetStream traffic on Huawei devices 137Configuring NetStream export. . . . . . . 137

Notices . . . . . . . . . . . . . . 139Trademarks . . . . . . . . . . . . . . 141Terms and conditions for product documentation 142

© Copyright IBM Corp. 2015, 2018 iii

iv Network Performance Insight References

Reference

Use the following reference information to enhance your understanding of IBM®

Network Performance Insight and to help you work with IBM NetworkPerformance Insight effectively.

Intended audienceThe audience who are network administrators or operations specialist responsiblefor installing the Network Performance Insight product suite on an enterprisenetwork.

To install Network Performance Insight successfully, you must have a thoroughunderstanding of the following subjects:v Network Performance Insight 1.2.2 systemv Basic principles of network protocols and network managementv NetFlow and Cisco IP SLA conceptsv Administration of the Linuxv Jazz™ for Service Managementv IBM Tivoli® Network Manager IP Editionv IBM Tivoli Netcool®/OMNIbus

OrganizationRead this summary to help you find the information that you need.

This information is organized as follows:v Chapter 1, “REST API definitions,” on page 1v Chapter 2, “Command line interface,” on page 63v Chapter 6, “Configuring Flow devices,” on page 119

Network Performance Insight architectureIBM Network Performance Insight is a network performance monitoring system. Itoffers both real-time and historical trends in network performance and interactiveview on the network data that helps in reduced network downtime and optimizednetwork performance.

Network Performance Insight provides IBM Netcool Operations Insight withcomprehensive IP network device performance monitoring and session trafficanalysis.

The following diagram shows how data is flowing through the variouscomponents in Network Performance Insight:

© Copyright IBM Corp. 2015, 2018 v

Network Performance Insight services

Network Performance Insight services are running on microservice architecturethat has the software application as a suite of independently deployable, small,modular services in which each service runs a unique process and communicatesthrough a well-defined, lightweight mechanism. Currently, Network PerformanceInsight 1.2.2 consists of the following microservices:

Foundation services

v Managerv DNSv Eventv Storagev UI

Entity Metric services

v Tivoli Network Manager Collectorv SNMP Collectorv Formula Servicev Entity Analyticsv Threshold

Flow Metric services

vi Network Performance Insight References

v Flow Collectorv Flow Analytics

For more information about these services, see their respective sections in IBMNetwork Performance Insight: Product Overview.

Network Performance Insight additional components

Some of the additional components that are introduced in Network PerformanceInsight V1.2.2 for enhanced functions are described here:

Performance Metric OOTB Device Support

Performance Metric OOTB Device Support provides some additionalpre-loaded, vendor-specific device performance SNMP metrics that can bediscovered and polled from Tivoli Network Manager system and the datacan be displayed on Network Performance Insight dashboards.

For more information, see Performance Metric OOTB Device Supportsection in IBM Network Performance Insight: Product Overview.

Network Performance Insight Dashboards

These interactive dashboards are the built-in JSON-based dashboards suitethat can display aggregated network data from Network PerformanceInsight database with the help of REST API calls. It supports a combinationof data from multiple data sources.

This feature provides a wide variety of dashboards for Network Operators,Network Engineers, and Network Capacity Planners. These dashboardshelp in pinpointing the troubled resources and general resourceperformance. A number of web-based configuration options are availableto control the data that is displayed on the dashboards.

For more information, see Network Performance Insight Dashboards section inIBM Network Performance Insight: Product Overview.

Note: Networks for Operations Insight is a solution extension of NetcoolOperations Insight that includes the following components and products:v Tivoli Network Managerv Tivoli Netcool Configuration Managerv Network Performance Insightv Network Health Dashboardv Device Dashboardv Topology Search

IBM Open Platform with Apache Spark and Apache Hadoopcomponents

IBM Open Platform with Apache Spark and Apache Hadoop (IOP) can be used tohelp process and analyze the volume, variety, and velocity of data that continuallyenters your organization every day. Network Performance Insight is installed as aservice extension to the installed IBM Open Platform with Apache Spark andApache Hadoop stack.

The features of IOP that are used in Network Performance Insight:

Reference vii

v IBM Open Platform with Apache Spark and Apache Hadoopv Default support for rolling upgrades for Hadoop servicesv Support for long-running applications within YARN for enhanced reliabilityv Spark in-memory distributed compute engine for dramatic performance increasev Apache Ambari operational framework. Apache Ambari is an open framework

for provisioning, managing, and monitoring Apache Hadoop clusters. Ambariprovides an intuitive and easy-to-use Hadoop management web UI backed byits collection of tools and APIs that simplify the operation of Hadoop clusters.

v Essentially includes the following open source technologies for working withNetwork Performance Insight:– HDFS– Kafka– Ambari– Spark– ZooKeeper

Note: Because Zookeeper requires a majority, it is best to use an odd numberof machines. For example, with four machines ZooKeeper can handle thefailure of a single machine; if two machines fail, the remaining two machinesdo not constitute a majority. However, with five machines ZooKeeper canhandle the failure of two machines.

Integrated products

Products that are integrated with Network Performance Insight 1.2.2:

Jazz for Service ManagementDashboard Application Services Hub provides visualization and dashboardservices in Jazz for Service Management. It has a single console foradministering IBM products and related applications. Visualization forNetwork Performance Insight is federated into Dashboard ApplicationServices Hub.

IBM Tivoli Network Manager IP EditionTivoli Network Manager provides network discovery, device polling,including storage of polled SNMP data for reporting and analysis, andtopology visualization. In addition, Network Manager can display networkevents, perform root-cause analysis of network events, and enrich networkevents with topology and other network data.

Tivoli Netcool/OMNIbus component of IBM Netcool Operations InsightNetcool Operations Insight is powered by the fault managementcapabilities of IBM Tivoli Netcool/OMNIbus. In Network PerformanceInsight V1.2.2, Tivoli Netcool/OMNIbus is an important part of thesolution for monitoring the network threshold violations.

Related information:

IBM Network Performance Insight on IBM Knowledge Center

IBM BigInsights 4.2 documentation

HDFS Architecture

Apache Hadoop YARN

Apache Kafka

viii Network Performance Insight References

http://www.ibm.com/support/knowledgecenter/SSPT3X_4.2.0/com.ibm.swg.im.infosphere.biginsights.product.doc/doc/bi_hadoop.html

http://www.ibm.com/support/knowledgecenter/SSPT3X_4.2.0/com.ibm.swg.im.infosphere.biginsights.product.doc/doc/bi_kafka.html

http://www.ibm.com/support/knowledgecenter/SSPT3X_4.2.0/com.ibm.swg.im.infosphere.biginsights.product.doc/doc/ambari.html

http://www.ibm.com/support/knowledgecenter/SSPT3X_4.2.0/com.ibm.swg.im.infosphere.biginsights.product.doc/doc/bi_spark.html

http://www.ibm.com/support/knowledgecenter/SSPT3X_4.2.0/com.ibm.swg.im.infosphere.biginsights.product.doc/doc/bi_zookeeper.html

http://www.ibm.com/support/knowledgecenter/SSCVHB

http://www.ibm.com/support/knowledgecenter/SSPT3X_4.2.0/com.ibm.swg.im.infosphere.biginsights.welcome.doc/doc/welcome.html

https://hadoop.apache.org/docs/r2.7.2/hadoop-project-dist/hadoop-hdfs/HdfsDesign.html#HDFS_Architecture

http://hadoop.apache.org/docs/current/hadoop-yarn/hadoop-yarn-site/YARN.html

http://kafka.apache.org/documentation.html

Apache Zookeeper

IBM Networks for Operations Insight

Service Management ConnectConnect, learn, and share with Service Management professionals and productsupport technical experts who provide their perspectives and expertise.

Access Network and Service Assurance community at https://www.ibm.com/developerworks/servicemanagement/nsa/index.html. Use Service ManagementConnect in the following ways:v Become involved with transparent development, an ongoing, open engagement

between other users and IBM developers of Tivoli products. You can access earlydesigns, sprint demonstrations, product roadmaps, and prerelease code.

v Connect one-on-one with the experts to collaborate and network about Tivoliand the Network and Service Assurance community.

v Read blogs to benefit from the expertise and experience of others.v Use wikis and forums to collaborate with the broader user community.Related information:

IBM Network Performance Insight community on developerWorks

Network Performance Insight technical trainingFor Tivoli technical training information, see the following Network PerformanceInsight Training website at https://tnpmsupport.persistentsys.com/updated_trainings.

Support informationIf you have a problem with your IBM Software, you want to resolve it quickly.IBM provides the following ways for you to obtain the support you need:

OnlineAccess the IBM Software Support site at https://www-947.ibm.com/support/servicerequest/newServiceRequest.action

IBM Support AssistantThe IBM Support Assistant is a free local software serviceability workbenchthat helps you resolve questions and problems with IBM Softwareproducts. The Support Assistant provides quick access to support-relatedinformation and serviceability tools for problem determination. To installthe Support Assistant software, go to https://www.ibm.com/software/support/isa.

Troubleshooting GuideFor more information about resolving problems, see the problemdetermination information for this product.

Conventions used in this publicationSeveral conventions are used in this publication for special terms, actions,commands, and paths that are dependent on your operating system.

Reference ix

http://zookeeper.apache.org/

https://www.ibm.com/support/knowledgecenter/SSTPTP_1.4.1/com.ibm.netcool_ops.doc/omn_nmip/task/nnm_noi_ins_extendtonetcooloperationsinsight.html

https://www.ibm.com/developerworks/servicemanagement/nsa/index.html

https://www.ibm.com/developerworks/servicemanagement/nsa/index.html

https://www.ibm.com/developerworks/community/groups/service/html/communitystart?communityUuid=eaa9489e-3122-440a-93a3-ee5cd204c603

https://tnpmsupport.persistentsys.com/updated_trainings

https://tnpmsupport.persistentsys.com/updated_trainings

https://www-947.ibm.com/support/servicerequest/newServiceRequest.action

https://www-947.ibm.com/support/servicerequest/newServiceRequest.action

https://www.ibm.com/software/support/isa

https://www.ibm.com/software/support/isa

Typeface conventionsThis publication uses the following typeface conventions:

Bold

v Lowercase commands and mixed case commands that are otherwisedifficult to distinguish from surrounding text

v Interface controls (check boxes, push buttons, radio buttons, spinbuttons, fields, folders, icons, list boxes, items inside list boxes,multicolumn lists, containers, menu choices, menu names, tabs, propertysheets), labels (such as Tip:, and Operating system considerations:)

v Keywords and parameters in text

Italic

v Citations (examples: titles of publications, diskettes, and CDs)v Words defined in text (example: a nonswitched line is called a

point-to-point line)v Emphasis of words and letters (words as words example: "Use the word

that to introduce a restrictive clause."; letters as letters example: "TheLUN address must start with the letter L.")

v New terms in text (except in a definition list): a view is a frame in aworkspace that contains data.

v Variables and values you must provide: ... where myname represents....

Monospace

v Examples and code examplesv File names, programming keywords, and other elements that are difficult

to distinguish from surrounding textv Message text and prompts addressed to the userv Text that the user must typev Values for arguments or command options

Bold monospace

v Command names, and names of macros and utilities that you can typeas commands

v Environment variable names in textv Keywordsv Parameter names in text: API structure parameters, command

parameters and arguments, and configuration parametersv Process namesv Registry variable names in textv Script names

x Network Performance Insight References

Chapter 1. REST API definitions

The APIs in Network Performance Insight that give access to the database data forconstructing the dashboards.

Using Network Performance Insight REST API commands requires the samepermissions as using the web interface. These REST APIs are available so that youcan retrieve the data outside of the web interface.

Each REST resource contains information such as URLs, functions, parameters,descriptions, sample input, and output data.

Common REST API status codes

HTTP status code Generic description

200 Success

400 Failure

Flow APIsREST APIs that are related Flow data that is collected by Flow Collector Serviceand analyzed by Flow Analytics Service.

aggregationProvides a list of Flow aggregations that are visible to the user.

URL

This API queries and retrieves information from CFG.AGGREGATION_DISABLEtable.http://[host]:[port]/service/dataset/flow/aggregation

http://<myserver.ibm.com>:8081/service/dataset/flow/aggregation

Method

The supported request type.HTTP GET

URL parameters

Name Required Default value Description

visible No true Fields that must bereturned.

Sample URLs/service/dataset/flow/aggregation/service/dataset/flow/aggregation/?visible=true

© Copyright IBM Corp. 2015, 2018 1

Response

The results are returned as JSON data that contains an array of the followingfields:

Name Data type Description

aggregation string The name of the aggregationfield.

agg_fields string The columns that are used togroup by for the calculationof aggregation.

aggregation_name string The name of the aggregationon the flow metric.

visible boolean A flag to indicate whetherthe aggregation is visible tothe user or not.

enabled boolean A flag to indicate whetherthe aggregation is enabled bythe administrator or not.

order_id number It indicates the sorting orderof this list.

JSON code with visible flag set to true:[

{"aggregation":"app","aggregation_name":"Top Applications","agg_fields":"APP_NAME","visible":true,"enabled":true,"order_id":1

},{

"aggregation":"app_srctos","aggregation_name":"Top Applications with Source ToS","agg_fields":"APP_NAME, SRC_TOS","visible":true,"enabled":true,"order_id":2

},{

"aggregation":"srcip","aggregation_name":"Top Sources","agg_fields":"SRC_IP","visible":true,"enabled":true,"order_id":3

},{

"aggregation":"srcip_app","aggregation_name":"Top Sources with Application","agg_fields":"SRC_IP, APP_NAME","visible":true,"enabled":true,"order_id":4

},{

"aggregation":"dstip","aggregation_name":"Top Destinations","agg_fields":"DST_IP",

2 Network Performance Insight References

"visible":true,"enabled":true,"order_id":5

},{

"aggregation":"dstip_app","aggregation_name":"Top Destinations with Application","agg_fields":"DST_IP, APP_NAME","visible":true,"enabled":true,"order_id":6

},{

"aggregation":"conv","aggregation_name":"Top Conversations","agg_fields":"SRC_IP, DST_IP","visible":true,"enabled":true,"order_id":7

},{

"aggregation":"conv_app","aggregation_name":"Top Conversations with Application","agg_fields":"SRC_IP, DST_IP, APP_NAME","visible":true,"enabled":true,"order_id":8

},{

"aggregation":"conv_tos","aggregation_name":"Top Conversations with ToS","agg_fields":"SRC_IP, DST_IP, SRC_TOS","visible":true,"enabled":true,"order_id":9

},{

"aggregation":"prot","aggregation_name":"Top Protocols","agg_fields":"PROTOCOL_ID","visible":true,"enabled":true,"order_id":10

},{

"aggregation":"prot_app","aggregation_name":"Top Protocols with Application","agg_fields":"PROTOCOL_ID, APP_NAME","visible":true,"enabled":true,"order_id":11

},{

"aggregation":"prot_srcip","aggregation_name":"Top Protocols with Source Ip","agg_fields":"PROTOCOL_ID, SRC_IP","visible":true,"enabled":true,"order_id":12

},{

"aggregation":"prot_dstip","aggregation_name":"Top Protocols with Destination Ip","agg_fields":"PROTOCOL_ID, DST_IP","visible":true,"enabled":true,"order_id":13

Chapter 1. REST API definitions 3

},{

"aggregation":"prot_conv","aggregation_name":"Top Protocols with Conversation","agg_fields":"PROTOCOL_ID, SRC_IP, DST_IP","visible":true,"enabled":true,"order_id":14

},{

"aggregation":"srcas","aggregation_name":"Top Source Autonomous System","agg_fields":"BGP_SRC_AS_NUM","visible":true,"enabled":true,"order_id":15

},{

"aggregation":"dstas","aggregation_name":"Top Destination Autonomous System","agg_fields":"BGP_DST_AS_NUM","visible":true,"enabled":true,"order_id":16

},{

"aggregation":"conv_as","aggregation_name":"Top Autonomous System Conversations","agg_fields":"BGP_SRC_AS_NUM, BGP_DST_AS_NUM","visible":true,"enabled":true,"order_id":17

},{

"aggregation":"srctos","aggregation_name":"Top Source ToS","agg_fields":"SRC_TOS","visible":true,"enabled":true,"order_id":18

},{

"aggregation":"hierarchy_queueid","aggregation_name":"Top QoS Hierarchies with Queue Id","agg_fields":"POLICY_QOS_CLASSIFICATION_HIERARCHY, POLICY_QOS_QUEUE_ID","visible":true,"enabled":true,"order_id":19

},{

"aggregation":"dstipgroup_app","aggregation_name":"Top Destination Ip Groups with Application","agg_fields":"DST_IP_GROUP, APP_NAME","visible":true,"enabled":true,"order_id":20

},{

"aggregation":"dstipgroup_prot","aggregation_name":"Top Destination Ip Groups with Protocol","agg_fields":"DST_IP_GROUP, PROTOCOL_ID","visible":true,"enabled":true,"order_id":21

},{

"aggregation":"dstipgroup_tos",


"aggregation_name":"Top Destination Ip Groups with Source ToS","agg_fields":"DST_IP_GROUP, SRC_TOS","visible":true,"enabled":true,"order_id":22

},{

"aggregation":"srcipgroup_app","aggregation_name":"Top Source Ip Groups with Application","agg_fields":"SRC_IP_GROUP, APP_NAME","visible":true,"enabled":true,"order_id":23

},{

"aggregation":"srcipgroup_prot","aggregation_name":"Top Source Ip Groups with Protocol","agg_fields":"SRC_IP_GROUP, PROTOCOL_ID","visible":true,"enabled":true,"order_id":24

},{

"aggregation":"srcipgroup_tos","aggregation_name":"Top Source Ip Groups with Source ToS","agg_fields":"SRC_IP_GROUP, SRC_TOS","visible":true,"enabled":true,"order_id":25

},{

"aggregation":"convgroup_app","aggregation_name":"Top Ip Group Conversations with Application","agg_fields":"SRC_IP_GROUP, DST_IP_GROUP, APP_NAME","visible":true,"enabled":true,"order_id":26

}]

JSON code with visible flag set to false:[

{"aggregation":"convgroup_prot","aggregation_name":"Top Ip Group Conversations with Protocol","agg_fields":"SRC_IP_GROUP, DST_IP_GROUP, PROTOCOL_ID","visible":false,"enabled":false,"order_id":1

},{

"aggregation":"convgroup_tos","aggregation_name":"Top Ip Group Conversations with Source ToS","agg_fields":"SRC_IP_GROUP, DST_IP_GROUP, SRC_TOS","visible":false,"enabled":false,"order_id":2

}]


interfaceProvides a list of all the flow interfaces that the system received from an exporter.This API is specific for Flow data alone.

URL

This API queries and retrieves information from FLOW_METRIC.INTERFACEtable.http://[host]:[port]/service/dataset/cfg/interface

http://<myserver.ibm.com>:8081/service/dataset/cfg/interface/?fields=*

Method


URL parameters

Name Required Description

fields No Fields that must be returned.

count No Number of flow interface records thatmust be returned.

sort No How the records must be sorted. Prefix +or - to indicate sort direction. For example,sort=+name,-description. You can givecomma-separated parameters for sorting.

condition No Expression that must be used to filterspecific records. For example,condition=name=test.

Sample URLs/service/dataset/cfg/interface/?fields=*

/service/dataset/cfg/interface/?fields=*&count=10

/service/dataset/cfg/interface/?fields=*&count=10&condition=direction=1&sort=+start_ms

/service/dataset/cfg/interface/?fields=*&count=10&condition=direction=1

Response



entity_id number Internal system ID for thereturned flow interface.

start_ms number Time at which the flowinterface is first known bythe system.

exporter_ip string IP address of the exporter onwhich the flow interfacesreside.



if_index number Index of the flow interfaceon the exporter.

direction number Direction of the flowinterface (0= ingress, 1=egress).

enabled boolean Flag that indicates for datacollection enablement in thesystem for the flow interface.

speed number Speed of the flow interface inbits per second.

if_name string Name of the flow interfaceas known by the exporter.

JSON code:[

{"entity_id":8589934713,"start_ms":1466008543902,"exporter_ip":"::1","if_index":1,"direction":0,"enabled":true,"speed":0,"if_name":"::1-1"

},{

"entity_id":8589934712,"start_ms":1466008543902,"exporter_ip":"::1","if_index":1,"direction":1,"enabled":true,"speed":0,"if_name":"::1-1"

},{


},{


},{

"entity_id":8589936517,"start_ms":1466008555871,"exporter_ip":"::1","if_index":3,


"direction":0,"enabled":true,"speed":0,"if_name":"::1-3"

},{


},{


},{


},{


},{


},{


},{

"entity_id":8589935288,


"start_ms":1466008549182,"exporter_ip":"::1","if_index":6,"direction":1,"enabled":true,"speed":0,"if_name":"::1-6"

},{


},{


},{


},{


},{


},{

"entity_id":8589935850,"start_ms":1466008551943,"exporter_ip":"::1","if_index":9,"direction":1,"enabled":true,


"speed":0,"if_name":"::1-9"

}]

qossummaryProvides the summary of policyQosQueueDrop flow metric that measures the QoSqueue drops. This API is applicable for Flow data only.

URL

This API queries and retrieves information from FLOW_METRIC.RAW, and otherFLOW_METRIC. 1MIN/30MIN/1DAY AGGREGATION tables.http://[host]:[port]/service/dataset/aggregation/qossummary

http://<myserver.ibm.com>:8081/service/dataset/aggregation/qossummary?entity=127.0.0.1-533&start=1505887200000&end=1505888940000&count=10

Method


URL parameters

Name RequiredDefaultvalue Description

entity Yes N/A The entity ID representing theinterface.

The three type of entities are:

v exporterIP-<ifIndex>

v ncim-<NCIM.NETWORK_INTERFACES. entityID>

v flow-<FLOW_METRIC.INTERFACE. entityID>

start Yes N/A The start of the period forwhich flow data that must bereturned.

end Yes N/A The end of the period for whichflow data that must bereturned.

time Yes N/A The name of time short cut:

v last-hour

v last-day

v last-week

v last-month

v last-year

count No -1 Number of queues to return.For example, top 10 talkers ofthe resource.



remaining No false A flag to indicate whether arow with the total of theremaining records must beprovided.

Sample URL/service/dataset/aggregation/qossummary?entity=127.0.0.1-533&start=1505887200000&end=1505888940000&count=10

/service/dataset/aggregation/qossummary?entity=ncim-342&time=last-hour

/service/dataset/aggregation/qossummary?entity=ncim-342&time=last-hour&remaining=true

Error response

For example:{"errorMesg": "Invalid start, end and granularity combination. Granularity : 1 minute StartMs :1568373360000 endMs : 1468375200000"}

Response



rank number Rank (1-10) of the record that is relativeto all other records. Rank 11 indicatesremaining records in total.

QueueId number Policy QoS Queue ID

hierarchyName string The hierarchy name for the queuecombined with policy name and classname in format <policyName>-<comma-separated-list of classNames>.

policyName string QoS policy name

classNames string QoS Class Name

droppedPackets number Sum of policyQosQueueDrop metric

droppedPacketPercent number Percent of policyQosQueueDrop for thisqueue over total policyQosQueueDrop forthis interface

droppedPacketOverTotalPacket number Percent of policyQosQueueDrop over totalnumber of packets that pass through thisinterface.

JSON code:[

{"rank":1,"policyName":"Policy1","hierarchyName":"Policy1-Class1","droppedPacketPercent":1.169494703290522,"droppedPacketOverTotalPacket":21.169494703290522,


"droppedPackets":499,"QueueId":13,"classNames":"Class1"

},{

"rank":2,"policyName":"Policy2","hierarchyName":"Policy2-Class1,Class11","droppedPacketPercent":1.3077716321364956,"droppedPacketOverTotalPacket":21.169494703290522,"droppedPackets":558,"QueueId":8,"classNames":"Class1,Class11"

}]

summaryProvides the top 10 values for an aggregation on a flow interface over a period.This API is specific for Flow data only.

URL

This API queries and retrieves information from FLOW_METRIC.RAW, and otherFLOW_METRIC. 1MIN/30MIN/1DAY AGGREGATION tables.http://[host]:[port]/service/dataset/aggregation/summary

http://<myserver.ibm.com>:8081/service/dataset/aggregation/summary?aggregation=app_srctos&entity=ncim-102&time=lasthour&granularity=1-minutes

Method


URL parameters


entity Yes N/A The entity ID that represents theinterface.

The three type of entities are:

v exporterIP-<ifIndex>

v ncim-<NCIM.NETWORK_INTERFACES.entityID>

v flow-<FLOW_METRIC.INTERFACE.entityID>

aggregation Yes N/A The aggregation ID that represents howthe data must be aggregated.

direction No Both The direction of the flow data that mustbe returned.

start Yes N/A The start time of the period for whichflow data must be returned.

end Yes N/A The end time of the period for whichflow data must be returned.




v last-hour

v last-day

v last-week

v last-month

granularity No See Notes. The granularity for which the data mustbe aggregated. For example, 5 minutes,14000 minutes.

remaining No false A flag to indicate whether a row with thetotal of the remaining records must beprovided.

extendedAppInfo No false A flag to indicate whether app baseaggregation result contains additionalNBAR, and NBAR2 applicationinformation as follows:

v description

v businessRelevance

v applicationGroup

v applicationCategory

v applicationSubcategory

v p2p_technology

v tunnelTechnology

v encryptedTechnology

Sample URL/service/dataset/aggregation/summary?aggregation=app_srctos&entity=ncim-102&time=lasthour&granularity=1-minutes

/service/dataset/aggregation/summary?aggregation=app&entity=ncim-102&time=lasthour&granularity=1-minutes&extendedAppInfo=true

Error response

For example:{"errorMesg": "Invalid start, end and granularity combination. Granularity : 1 minute StartMs :1568373360000 endMs : 1468375200000"}{"errorMesg":"Missing mandatory parameter :aggregation"}

Response



rank number Rank (1-10) of the record thatis relative to all otherrecords. Rank 11 indicatesremaining records in total.



application string Application name asspecified in the NBAR2Protocol Pack.Note: Applicable only if theextendedAppInfo parameteris enabled.

description string Description of theapplication as specified inthe NBAR2 Protocol Pack.Note: Applicable only if theextendedAppInfo parameteris enabled.

srctos string Note: Applicable only if theextendedAppInfo parameteris enabled.

octets number The aggregated octets valuefor a time period

packets number The aggregated packetsvalue for a time period

percentage number The relative percentage oftotal octets for a time period.

maxThroughput number The granularity wise maxthroughput(octets) for a timeperiod

avgThroughput number The granularity wise avgthroughput(octets) for a timeperiod

maxUtilization number The granularity wise maxutilization(octets) for a timeperiod

avgUtilization number The granularity wise maxutilization(octets) for a timeperiod

label string Aggregation key values thatare separated by /.

businessRelevance string Specifies whether theapplication is consideredrelevant to the businessactivity of the organization.Note: Applicable only if theextendedAppInfo parameteris enabled.

applicationGroup string Allows the configuration ofapplications that are groupedbased on the samenetworking application asthe match criteria.Note: Applicable only if theextendedAppInfo parameteris enabled.



applicationCategory string Allows you to configureapplications that are groupedbased on the first level ofcategorization for eachprotocol as the matchcriteria.Note: Applicable only if theextendedAppInfo parameteris enabled.

applicationSubCategory string Provides the option toconfigure applications thatare grouped based on thesecond level of categorizationfor each protocol as thematch criteria.Note: Applicable only if theextendedAppInfo parameteris enabled.

p2p_technology string Provides the option toindicate whether a protocoluses p2p technology.Note: Applicable only if theextendedAppInfo parameteris enabled.

tunnelTechnology string Provides the option toconfigure protocols based onwhether a protocol tunnelsthe traffic of other protocols.Note: Applicable only if theextendedAppInfo parameteris enabled.

encryptedTechnology string Provides the option toconfigure applications thatare grouped based onwhether the protocol is anencrypted protocol or not asthe match criteria.Note: Applicable only if theextendedAppInfo parameteris enabled.

Note:

v The actual fields returned depend on the type of aggregation in the URL. Therank, octets, and percentage values are constant for all aggregations.

v If granularity is not provided, it is computed as follows:– If time range is <= 3 hours, granularity = 1 minute.– If time range is >3 hour and <=12 hour, granularity = 15 minutes.– If time range is >12 hour and <=7 days, granularity = 30 minutes.– If time range is between 7 and <90 days, granularity = 1 day.– If time range is >=90 days, granularity = 7days.

The supported aggregations are as follows:v app – (application)


v app_srctos – (applications, source tos)v conv – (source, destination)v conv_app – (source, destination, application)v conv_as – (source autonomous system conversation, destination autonomous

system conversationv conv_tos – (conversations, tos)v convgroup_app – (source ip group, destination ip group, application)v convgroup_prot – (source ip group, destination ip groups, protocol)v convgroup_tos – (source ip group, destination ip groups, source tos)v dstas – (destination autonomous system)v dstip – (destination)v dstip_app – (destination, application)v dstipgroup_app – (destination ip group, application)v dstipgroup_prot – (destination ip group, protocol)v dstipgroup_tos – (destination ip group, source tos)v hierarchy_queueid – (QoS hierarchies with classification, QoS hierarchies with

queue id)v prot – (protocol)v prot_app – (protocol, application)v prot_conv – (protocol, source, destination)v prot_dstip – (protocol, destination)v prot_srcip – (protocol, source)v srcas – (source autonomous system)v srcip – (source)v srcip_app – (source, application)v srcipgroup_app – (source ip group, application)v srcipgroup_prot – (source ip group, protocol)v srcipgroup_tos – (source ip group, source tos)v srctos – (source tos)

JSON code:[

{"rank":1,"application":"ftp","srctos":"AF13","label":"ftp/AF13","octets":22866690,"packets":44379,"percentage":19.43,"maxThroughput":532756.93,"avgThroughput":190555.75,"maxUtilization":0.05,"avgUtilization":0.02

},{

"rank":2,"application":"ssh","srctos":"AF13","label":"ssh/AF13","octets":16502348,"packets":35801,"percentage":14.02,


"maxThroughput":318072.67,"avgThroughput":137519.57,"maxUtilization":0.03,"avgUtilization":0.01

},{

"rank":3,"application":"http","srctos":"AF13","label":"http/AF13","octets":16055850,"packets":38910,"percentage":13.64,"maxThroughput":370810.53,"avgThroughput":152912.86,"maxUtilization":0.04,"avgUtilization":0.02

},{

"rank":4,"application":"https","srctos":"AF13","label":"https/AF13","octets":10447134,"packets":18166,"percentage":8.88,"maxThroughput":260432.53,"avgThroughput":107150.09,"maxUtilization":0.03,"avgUtilization":0.01

},{

"rank":5,"application":"bootps","srctos":"AF13","label":"bootps/AF13","octets":9739971,"packets":17876,"percentage":8.28,"maxThroughput":230403.47,"avgThroughput":118060.25,"maxUtilization":0.02,"avgUtilization":0.01

},{

"rank":6,"application":"nicname","srctos":"AF13","label":"nicname/AF13","octets":9577779,"packets":19000,"percentage":8.14,"maxThroughput":178783.87,"avgThroughput":91216.94,"maxUtilization":0.02,"avgUtilization":0.01

},{

"rank":7,"application":"sqlserv","srctos":"AF13","label":"sqlserv/AF13","octets":9437316,"packets":26845,"percentage":8.02,"maxThroughput":340232.93,"avgThroughput":125830.88,


"maxUtilization":0.03,"avgUtilization":0.01

},{

"rank":8,"application":"domain","srctos":"AF13","label":"domain/AF13","octets":9058840,"packets":14997,"percentage":7.70,"maxThroughput":287669.60,"avgThroughput":109804.12,"maxUtilization":0.03,"avgUtilization":0.01

},{

"rank":9,"application":"irc","srctos":"AF13","label":"irc/AF13","octets":7185223,"packets":9944,"percentage":6.10,"maxThroughput":197913.07,"avgThroughput":106447.75,"maxUtilization":0.02,"avgUtilization":0.01

},{

"rank":10,"application":"bootpc","srctos":"AF13","label":"bootpc/AF13","octets":6827520,"packets":9747,"percentage":5.80,"maxThroughput":159044.53,"avgThroughput":82757.82,"maxUtilization":0.02,"avgUtilization":0.01

}]

Response for the URL with extendedAppInfo flag set:[

{"rank":1,"application":"ftp","description":"","businessRelevance":"","applicationGroup":"","applicationCategory":"","applicationSubCategory":"","p2p_technology":"","tunnelTechnology":"","encryptedTechnology":"","label":"ftp","octets":1627476,"packets":5392,"percentage":17.00,"maxThroughput":216996.80,"avgThroughput":216996.80,"maxUtilization":0.02,"avgUtilization":0.02

},


{"rank":2,"application":"bootps","description":"","businessRelevance":"","applicationGroup":"","applicationCategory":"","applicationSubCategory":"","p2p_technology":"","tunnelTechnology":"","encryptedTechnology":"","label":"bootps","octets":1600439,"packets":3975,"percentage":16.71,"maxThroughput":213391.87,"avgThroughput":213391.87,"maxUtilization":0.02,"avgUtilization":0.02

}]


NBAR Categorization and Attributes

NBAR2 Protocol Pack 33.0.0

thresholdProvides a list of all the thresholds on Flow data in the system. This API is specificfor Flow data only.

URL

This API queries and retrieves information from CFG.THRESHOLD table.http://[host]:[port]/service/dataset/cfg/threshold

http://<myserver.ibm.com>:8081/service/dataset/cfg/threshold/?fields=*

Method


URL parameters


fields No Fields that must be returned.

count No Number of Flow interfacerecords that must be returned.

sort No How the records must be sorted.Prefix + or - to indicate sortdirection. For example,+metric,-upper_limit indicatesto sort by metric ascending, andthen sort by upper_limitdescending. You can givecomma-separated parameters forsorting.


https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/qos_nbar/configuration/xe-3s/qos-nbar-xe-3s-book/nbar-app-recog-mods.html?bookSearch=true

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/qos_nbar/prot_lib/config_library/pp3300/nbar-prot-pack3300.html


condition No Expression that must be used tofilter specific records. Forexample, condition=name=test.

Sample URLs/service/dataset/flow/threshold/?fields=*

/service/dataset/flow/threshold/?fields=*&count=5

/service/dataset/flow/threshold/?fields=*&count=10&condition=direction=1&sort=+start_ms

/service/dataset/flow/threshold/?fields=*&count=10&condition=direction=1

Response



entity_id number The internal system ID forthe returned Flow interface

metric_id number The internal system ID forthe metric

start_ms number The system time whenthreshold is configured.

period_sec number The accumulated time inseconds when the thresholdis monitored.

enabled boolean Flag to indicate whetherthreshold monitoring isenabled in the system for theFlow interface.

kind number The type of thresholdmonitored. 0 is StaticThreshold and 1 is LearnedThreshold.Note: Currently, it is notsupported and it alwaysreturns 0.

limit_type number The limit type for thresholdmonitored.

v 0 is Over

v 1 is Under

v 2 is Band

upper_limit number The upper bound limit forthe threshold monitored

lower_limit number The lower bound limit forthe threshold monitored

num_events number The number of events thatare generated on the Flowinterface.



learning_days number The number of days for thesystem to learn the pattern.Note: Currently, it is notsupported.

interface_id number The internal system ID forthe returned Flow interface

direction number The direction of the Flowinterface (0=ingress,1=egress)

speed number The speed of the Flowinterface in bits per second

exporter_ip string The IP address of theexporter on which the Flowinterfaces reside.

if_index number The index of the Flowinterface on the exporter

if_name string The name of the Flowinterface as known by theexporter

JSON code:[

{"entity_id":8589934601,"metric_id":1,"start_ms":1472466812124,"period_sec":60,"enabled":false,"kind":0,"limit_type":0,"upper_limit":80923502,"lower_limit":60692626,"num_events":2,"learning_days":0,"interface_id":8589934601,"direction":0,"speed":0,"exporter_ip":"::1","if_index":1,"if_name":"::1-1"

},{

"entity_id":8589934600,"metric_id":1,"start_ms":1472466812125,"period_sec":60,"enabled":false,"kind":0,"limit_type":0,"upper_limit":62739672,"lower_limit":47054754,"num_events":2,"learning_days":0,"interface_id":8589934600,"direction":1,"speed":0,"exporter_ip":"::1",


"if_index":1,"if_name":"::1-1"

}]

timeseriesProvides a timeseries of data for an aggregation on a flow interface over a period.For timeseries return with top10 query, the utilization is only calculated if thespeed information is available in NCIM database. If the information is notavailable, value null is returned.

URL

This API queries and retrieves information from FLOW_METRIC.RAW, and otherFLOW_METRIC. 1MIN/30MIN/1DAY AGGREGATION tables.http://[host]:[port]/service/dataset/aggregation/timeserieshttp://[host]:[port]/service/dataset/aggregation/timeseries/top10

http://<myserver.ibm.com>:8081service/dataset/aggregation/timeseries?entity=ncim-217&direction=ingress&aggregation=conv_app&start=1466008260000&end=1466011860000&granularity=1-minute&key=221.87.136.94%252F176.188.66.226%2520%252F%2520ftp-data

Method


URL parameters


entity Yes N/A The entity ID that representsthe interface.

aggregation Yes N/A The aggregation ID thatrepresents how the data mustbe aggregated.

direction No Both The direction of the flow datathat must be returned.

start Yes N/A The start time of the period forwhich flow data must bereturned.

end Yes N/A The end time of the period forwhich flow data must bereturned.

granularity No N/A The granularity for which thedata must be aggregated. Thedefault granularity can be asfollows:

v 1-minute

v 15-minute

v 30-minute

v 1-day

v 7-day



key Yes

No (For top10query)

N/A Combination of grouping keysthat are separated by /. Thiskey must be in the sameaggregation order and supportonly the top 10 grouping fromaggregation summary.

The grouping key value mustbe same as the grouping resultof aggregation summary API.The key parameter is ignoredfor top10 where all top 10timeseries data is returned.


v last-hour

v last-day

v last-week

v last-month

v last-year

suppressSummary No false Output result without resultsummary portion.

Sample URL/service/dataset/aggregation/timeseries?entity=ncim-217&direction=ingress&aggregation=conv_app&start=1466008260000&end=1466011860000&granularity=1-minute&key=221.87.136.94%252F176.188.66.226%2520%252F%2520ftp-data

/service/dataset/aggregation/timeseries/top10?entity=ncim-217&direction=ingress&aggregation=conv_app&start=1466008260000&end=1466011860000&granularity=1-minute

Note:

v The query supports the top 10 grouping from the aggregation summary for theprovided time period.

v This query runs on aggregation summary result cache and the parameter keyvalue must be as appeared in aggregation summary API result.

v If granularity is not provided, it is computed as follows:– If time range is <= 3 hours, granularity = 1 minute.– If time range is >3 hour and <=12 hour, granularity = 15 minutes.– If time range is >12 hour and <=7 days, granularity = 30 minutes.– If time range is between 7 and <90 days, granularity = 1 day.– If time range is >=90 days, granularity = 7days.

Error response

For example:{"errorMesg":"Missing mandatory parameter :aggregation"}{"errorMesg": "Invalid start, end and granularity combination. Granularity : 1 minute StartMs :1568373360000 endMs : 1468375200000"}{"errorMesg":"Key parameter must be provided"}


Response

The timeseries API query results are returned as JSON data that contains an arrayof the following fields:


timestamp number The time that is associatedwith the aggregated value.

value number The aggregated octets valuefor the associated time

JSON code:[

{"timestamp":1466008980000,"value":999771

},{

"timestamp":1466008990000,"value":999771

},{

"timestamp":1466009000000,"value":999771

},{

"timestamp":1466009100000,"value":999771

}]

The timeseries/top10 API query results are returned as JSON data that containsan array of the header and result fields as follows:

Table 1. Header fields


interface number The interface for which top10 timeseries is calculated.

direction number The direction of the interface

exporter string The exporter IP of theinterface

keysSeparator string The separator that is used forcombining the groupingkeys.

keys string The grouping keys that areused for the aggregation.

speed long The speed of the interface.

Table 2. Result Fields


key string The grouping key value for thisrecord,

timestamp long The time that is associated withthe aggregated value.


Table 2. Result Fields (continued)


sumOctet long The sumoctets that is calculatedfor this grouping key value.

sumPacket long The sumpackets that is calculatedfor this grouping key value.

throughput double The number of packetsaggregated per granularityspecified.

utilization string It is the throughput based onspeed of the interface.

JSON code without timeseries/top10 query[

{"timestamp":1466008980000,"value":999771

},{

"timestamp":1466008990000,"value":999771

},{

"timestamp":1466009000000,"value":999771

},{

"timestamp":1466009100000,"value":999771

}]

JSON code for timeseries/top10 query:{

"interface":1,"direction":"ingress","exporter":"127.0.0.1","keysSeparator":"/","speed":10000000,"keys":[

"srcIp","dstIp","appName"

],"timeseries":[

{"key":"56.199.177.191/40.47.23.8/https","timestamp":1503540000000,"sumOctet":998005,"sumPacket":8457,"throughput":887.1155555555556,"utilization":0.008871155555555557

},{

"key":"192.178.122.236/61.186.117.57/https","timestamp":1503540000000,"sumOctet":996126,"sumPacket":1617,"throughput":885.4453333333333,"utilization":0.008854453333333333

},


{"key":"132.118.233.143/212.104.175.192/nntp","timestamp":1503540000000,"sumOctet":999710,"sumPacket":1308,"throughput":888.6311111111111,"utilization":0.00888631111111111

},{

"key":"176.3.79.144/98.139.180.149/ipv6:21","timestamp":1503540000000,"sumOctet":996046,"sumPacket":4955,"throughput":885.3742222222222,"utilization":0.008853742222222223

},{

"key":"212.219.83.229/91.32.174.183/ftp","timestamp":1503540000000,"sumOctet":999397,"sumPacket":4714,"throughput":888.3528888888889,"utilization":0.008883528888888888

},{

"key":"143.94.84.129/89.245.62.143/ftp-data","timestamp":1503540000000,"sumOctet":997156,"sumPacket":1959,"throughput":886.3608888888889,"utilization":0.00886360888888889

},{

"key":"149.86.219.239/5.191.66.50/ipv6:445","timestamp":1503540000000,"sumOctet":999563,"sumPacket":962,"throughput":888.5004444444445,"utilization":0.008885004444444445

},{

"key":"232.149.79.235/18.156.162.132/sctp:68","timestamp":1503540000000,"sumOctet":999358,"sumPacket":4781,"throughput":888.3182222222222,"utilization":0.008883182222222223

},{

"key":"remaining","timestamp":1503540000000,"sumOctet":1096729557,"sumPacket":7823086,"throughput":9001125.84088889,"utilization":90.01125840888889

},{

"key":"127.105.91.253/251.24.126.55/ftp","timestamp":1503540000000,"sumOctet":999579,"sumPacket":1516,"throughput":888.5146666666667,"utilization":0.008885146666666668

},{

"key":"165.147.4.136/132.106.235.232/ipv6:53","timestamp":1503540000000,


"sumOctet":999932,"sumPacket":1022,"throughput":888.8284444444445,"utilization":0.008888284444444445

}]

}

Metric APIsREST APIs that retrieve entity metric data that is collected by Network ManagerCollector Service and analyzed by Entity Analytics Service.

anomaliesProvides anomalies in timeseries entity metric data. This information is used in theDevice Dashboard to display the network anomalies.

URL

This API queries and retrieves information from THRESHOLD.STATE table.http://[host]:[port]/service/dataset/metric/anomalies

http://<myserver.ibm.com>:8081/service/dataset/metric/anomalies

Method


URL parameters


entities No N/A Comma-separated list of ncimentity IDs.

entityNames No N/A Comma-separated list of entitynames

metrics Yes N/A Comma-separated names of themetrics and their aggregationexpression.

parents No N/A Comma-separated list of mainnode ID.

parentNames No N/A Comma-separated list of ncimdevice names

searchByProperties No N/A Properties filter in this format:

"<propertyName>"<ops>’<propertyValue>’

Note: Property name and valueare case-sensitive.For example:

"IFTYPESTRING"=’ethernet-csmacd’

start No N/A The start of the period forwhich flow data that must bereturned.



end No N/A The end of the period for whichflow data that must bereturned.

time No N/A The name of time short cutused. For example:

v last-hour

v last-day

v last-week

v last-month

v last-year

excludeParent No false A flag to exclude the parent IDfrom response.

childTypes No * Comma-separated list of entitytypes of node that must befiltered in the result. SupportedchildTypes filter values areinterface, device, probe, and *(All).

entityResourceTypes No N/A Entity Type of node that mustbe filtered in result. Forexample:

v interface

v device

v probe

v physicalcard

v artTarget

v qosQueue

Sample URLs/service/dataset/metric/anomalies?entities=ncim-59,ncim-81,ncim-86&time=lastweek&metrics=ifInDiscards

/service/dataset/metric/anomalies?entities=ncim-59&start=1466008260000&end=1466011860000&metrics=ifInDiscards

/service/dataset/metric/anomalies?entities=ncim-59&start=1466008260000&end=1466011860000&metrics=ifInDiscards,ifOutDiscards

/service/dataset/metric/anomalies?entityNames=T1 1/1,T1 1/2&start=1466008260000&end=1466011860000&metrics=ifInDiscards

/service/dataset/metric/anomalies?parents=1,2&entities=ncim-59&start=1466008260000&end=1466011860000&metrics=ifInDiscards,ifOutDiscards

/service/dataset/metric/anomalies?parentNames=10.55.239.42,10.55.239.4&entityNames=T11/1&start=1466008260000&end=1466011860000&metrics=ifInDiscards

/service/dataset/metric/anomalies?start=1466008260000&end=1466011860000&metrics=ifInDiscards&searchByProperties="PHYSICALADDRESS"=’30’ AND "LOCATION"=’KL’

/service/dataset/metric/anomalies?parents=3&metrics=snmpInBandwidth&time=lastday&childTypes=interface,device

Note:

v At least one or more of the following parameters must be provided:– entities


– parents

– entityNames

– parentNames

– searchByProperties

– entityResourceTypes

v time or a combination of start AND or OR end must be provided.v time parameter is superseded by combination of start AND or OR end if both

combinations are present and it must support last-hour and last_day only.v Supported operators for properties filter are as follows:

– ,– =– <>– IN– LIKE– AND– ORFor example:searchByProperties="sysName"=’"10.55.239.40"’ AND "If"=’897’searchByProperties="sysName"=’"10.55.239.40"’ AND "If" IN (’897’,’898’)searchByProperties="sysName" like ’"10.55.239.%25"’ AND "If"=’897’

Note: “%” is reserved keyword. It must be encoded with %25.

Error Response{"errorMesg":"Either entities, parents, entityNames, parentNames or searchByProperties should beprovided"}{"errorMesg": "Invalid start, end and granularity combination. Granularity : 1 minute StartMs :1568373360000 endMs : 1468375200000"}

Response



entity number The entity that is associated with thetime and metric value.

parent number The parent entity ID that is associatedwith the entity. The value is defaulted to-1 if enrichment fails.

entityName string The entity name. The value is defaultedto unknown if enrichment fails.

parentName string The entity’s parent name. The value isdefaulted to unknown if enrichment fails.

metric string The metric name for the associated timeand metric value.

type string The type of anomaly that is detected.

severity string The severity of the anomaly.



start number The time that is associated with the startof the anomaly.

end number The time that is associated with the endof the anomaly.

This field is available when the anomalyis ended, but not when anomaly is stilloutstanding.

value number The last violation metric value for theassociated time

details string JSON blob that contains the details ofthe anomaly.

JSON code:[

{"parent":6,"entityName":"","parentName":"10.55.239.2","metric":"ifInDiscards","entity":59,"details":"{’effectiveTimeStamp’:1472098732320,’limitType’:0,’upperLimit’:10,’lowerLimit’:5,’numEvents’:2}","severity":"critical","type":"StaticThreshold","start":1472099473383,"value":20

},{

"parent":6,"entityName":"0","parentName":"10.55.239.2","metric":"ifInDiscards","entity":81,"details":"{’effectiveTimeStamp’:1472098732320,’limitType’:0,’upperLimit’:10,’lowerLimit’:5,’numEvents’:2}","severity":"critical","type":"StaticThreshold","start":1472099473384,"value":10

}]

deviationComputes deviation for the current data that is compared against average value onthe same day of week over N number of weeks.

URL

The deviation REST API is used to compare against an aggregated metric datafrom a specific start and end time stamp and lookBackWeek to produce a TopNresource list.

Consider the following scenario:v You provide a start and end time from 1 AM - 2 AM Monday, 28 August 2017.v You select the lookBackWeek of 1.v You select the average value for a specific metric.

In this scenario, the deviation REST API queries all the related device types;interface, physical card, and probe, and the average value of the metric for theperiod of 7 days earlier, that is, Monday , 21 August 2017. The API also comparesthe results and retrieves the top ranking list.


This API queries and retrieves information from ENTITY_METRIC.AGG_030MIN,ENTITY_METRIC.RAW, NCIM.NETWORK_INTERFACES tables.http://[host]:[port]/service/dataset/metric/deviation

http://<myserver.ibm.com>:8081/service/dataset/metric/deviation

Method


URL parameters


entities No N/A Comma-separated list of entity IDs


metrics Yes N/A Comma-separated names of themetrics. Also supports metric IDs.

parents No N/A Comma-separated list of mainnode IDs.Note: Must be associated withchildTypes for ART, QoS relatedmetrics.

parentNames No N/A Comma-separated list of ncimdevice names.Note: Must be associated withchildTypes for ART and QoSrelated metrics.





start No N/A The start time for which flow datamust be returned.Note: The start and end timeperiods for deviation must beminimum 30 minutes and notlonger than 1 day.

end No N/A The end time for which flow datamust be returned.Note: The start and end timeperiods for deviation must beminimum 30 minutes and notlonger than 1 day.

time No N/A Specific time values:

v last-hour

v last-day

Note: You need either start/endor time parameters in the URL.



lookBackWeek Yes N/A The number of weeks to look back.lookBackWeek for deviation isalways <=4.

scope No

Yes forART/QoSmetrics

ibm-itnm

flow

Scope of the resource. Scope isrequired for ART, QoS relatedmetrics.

childTypes No * Comma-separated list of entitytypes of nodes that must befiltered in the result. By default, itis device and interface. SupportedchildTypes filter values are asfollows:

v interface

v device

v probe

v physicalcard

v artTarget

v qosQueue

v * (All)

suppressSummary No false Output the result without thesummary portion.

count No -1 Number of entities summary thatmust be returned. Combined withsort provides topN or bottomNfunctions. The default value -1returns all available records.

page No 1 The index of the page with data toreturn. It must be supplied withcount parameter to indicate thepage size.

properties No N/A Comma-separated list of propertiesto output.

flowEnabled No false If set to true, the result mustcontain the flow enabled entities.

entityResourceTypes No N/A Entity Type of node that must befiltered in result. For example:

v interface

v device

v probe

v physicalcard

v artTarget

v qosQueue

excludeParent No false A flag to exclude the parent IDsfrom response.

parentChildRelation No union Set operation between result fromparent ID search and entity IDsearch. For example, intersection,union.


Sample URLs/service/dataset/metric/deviation?entities=ncim-217&metrics=snmpInBandwidth&start=1466008260000&end=1466011860000

/service/dataset/metric/deviation?entities=ncim-217,ncim-218&metrics=snmpInBandwidth&time=last-hour

/service/dataset/metric/deviation?entities=ncim-217&metrics=snmpInBandwidth&time=last-hour/service/dataset/metric/deviation?entities=ncim-217&metrics=snmpInBandwidth&start=1466008260000&end=1466011860000

/service/dataset/metric/deviation?entityNames=T1 1/1,T1 1/2&metrics=snmpInBandwidth&start=1466008260000&end=1466011860000

/service/dataset/metric/deviation?entities=ncim-217,ncim-218&metrics=snmpInBandwidth&time=last-hour

/service/dataset/metric/deviation?metrics=snmpInBandwidth&time=lasthour&searchByProperties="PHYSICALADDRESS"=’30’ AND "LOCATION"=’KL’

/service/dataset/metric/deviation?parents=3&metrics=snmpInBandwidth&time=lastday&childTypes=interface,device

/service/dataset/metric/deviation?parents=760&metrics=PingResult&time=last-day&lookBackWeek=4

Note:


– parents

– entityNames

– parentNames



v Supported operators for properties filter are as follows:– ,– =– <>– IN– LIKE– AND– ORFor example:searchByProperties="sysName"=’"10.55.239.40"’ AND "If"=’897’searchByProperties="sysName"=’"10.55.239.40"’ AND "If" IN (’897’,’898’)searchByProperties="sysName" like ’"10.55.239.%25"’ AND "If"=’897’

Note: “%” is reserved keyword. It must be encoded with %25.v time or a combination of start AND or OR end must be provided.v start and end range must be minimum of 30 minutes and maximum 1 day.v time parameter is superseded by combination of start AND or OR end. It must

support last-hour or last_day only.v lookBackWeek parameter must contain the value greater than 0.v count parameter must be used to get top N resources.v Data must always be sorted by deviation value.

Error response

For example:


{"errorMesg":"Either entities, parents, entityNames, parentNamesor searchByProperties should be provided"}{"errorMesg":"lookBackWeek is a mandatory parameter and shouldcontain value greater than zero"}{"errorMesg":"Time range between start and end should be minimum 30-minsto maximum 1 day"}{"errorMesg":"Metric Deviation Servlet support only 1 metric"}

Response



total number Total number of records available

page number Current page number

count number Number of records in the page

items list The list of entity metric summary

entity number The entity ID that is associated withthe time and metric value.

parent number The parent Entity ID that is associatedwith the entity.

entityName string The entity name. This value isdefaulted to unknown, if enrichmentfails.

parentName string Parent entity name. This value isdefaulted to unknown, if enrichmentfails.

startTimestamp number The start time that is associated withthe metric value.

endTimestamp number The end time that is associated withthe metric value.

metric string The metric name for the associatedtime and metric value. If metricId isused for search, this attribute returnsthe metric name.

rank number The rank (1-N) of the record relative toall other entities based on sort. Defaultis 0 if sort parameter is not provided.

devValues number The metric deviation value for theassociated time, entity, and metricexpression.

properties map Map of properties that are given ininput parameters and their values.

inIfId number In interface IDs for given entities ifenriched.

outIfId number Out interface IDs for given entities ifenriched.

JSON code without suppressSummary flag set:{

"total":27,"page":1,"count":27,


"items":[{

"entity":59,"parent":59,"entityName":"entityName","parentName":"parentName","startTimestamp":1469515500000,"endTimestamp":1469615500000,"rank":1,"devValues":100,"metricId":"MetricName","metric":10,"inIfId":11,"outIfId":12

},{


}]

}

JSON code with suppressSummary flag set:[

{"entity":59,"parent":59,"entityName":"entityName","parentName":"parentName","startTimestamp":1469515500000,"endTimestamp":1469615500000,"rank":1,"devValues":100,"metricId":"MetricName","metric":10,"inIfId":11,"outIfId":12

},{


}]


entityProvides a list of entities and their properties for a resource type and searchconditions.

URL

This API queries and retrieves information from NCIM.NETWORK_INTERFACES,INVENTORY.ENTITY_NAME, INVENTORY.ENTITY_PROPERTIES andENTITY_METRIC.RAW and ENTITY_METRIC aggregated tables.http://[host]:[port]/service/dataset/metric/entity

http://<myserver.ibm.com>:8081/service/dataset/metric/entity

Method


URL parameters


entityResourceTypes No N/A Comma-separated list of entityIDs

all No false Comma-separated list of entitynames

searchByEntity No N/A Comma-separated list of EntityIDs, Entity names, Parent EntityIDs, Parent Entity names, andtype. <entity_column> can contain<entity_id>, <entity_name>,<parent_entity_id>, <parent_name>,and <type>.

<entity_column> <ops> ’<value>’

For example:

entity_id=’449900’

properties No N/A Comma-separated list ofproperties to output.








Sample URLs/service/dataset/metric/entity?entityResourceTypes=device

/service/dataset/metric/entity?entityResourceTypes=interface&flowEnabled=true

/service/dataset/metric/entity?entityResourceTypes=device&all=true

/service/dataset/metric/entity?searchByEntity=parentName=’10.55.239.249’

/service/dataset/metric/entity?entityResourceTypes=interface&flowEnabled=true

Note:


– parents

– entityNames

– parentNames

– searchByEntity



v Supported fields for searchByEntity are as follows:– parentName

– entityName

– entityId

– parentEntityId

v Supported operators for properties filter are as follows:– ,– =– <>– IN– LIKE– AND– ORFor example:searchByProperties="sysName"=’"10.55.239.40"’ AND "If"=’897’searchByProperties="sysName"=’"10.55.239.40"’ AND "If" IN (’897’,’898’)searchByProperties="sysName" like ’"10.55.239.%25"’ AND "If"=’897’

Note: “%” is reserved keyword. It must be encoded with %25.v Supported pattern for searchByEntity is as follows:

searchByEntity=parentName=’10.55.239.249’

Error response

For example:{"errorMesg":"Either entities, parents, entityNames, parentNames, entityResourceTypes,searchByEntity or serachByProperties should be provided"}

Response




entityId number An entity ID

entityName string Name of the entity

parentId number Parent entity ID

parentName string Parent entity name

properties map Map of properties that are given ininput parameters their values.

inIfId number Inbound interface IDs for the entities ifthey are enriched.

outIfId number Outbound interface IDs for the entitiesif they are enriched.

JSON code without flowEnabled flag set is as follows:[

{"entityId":-1,"entityName":"ALL","parentId":-1,"parentName":"ALL"

},{

"entityId":5,"entityName":"10.55.239.202","parentId":5,"parentName":"10.55.239.202"

},{


},{


},{


},{


},{


},{

"entityId":8,"entityName":"10.55.239.250","parentId":8,


"parentName":"10.55.239.250"},{


}]

JSON code with flowEnabled flag set is as follows:[

{"entityId":995,"inIfId":8589936607,"entityName":"Se1/0:0","parentName":"10.55.239.250","outIfId":8589936606,"parentId":960

}]

lastValueRetrieves the last value of metric data.

URL

This API queries and retrieves information from ENTITY_METRIC.RAW table.http://[host]:[port]/service/dataset/metric/lastValue

http://<myserver.ibm.com>:8081/service/dataset/metric/lastValue?entities=ncim-217,ncim-218&metrics=snmpInBandwidth&time=last-hour

Method


URL parameters


entities No N/A Comma-separated list of entityIDs


metrics Yes N/A Comma-separated names of themetrics. Also supports metricIDs.

parents No N/A Comma-separated list of mainnode IDs.Note: Must be associated withchildTypes for ART, QoS relatedmetrics.

parentNames No N/A Comma-separated list of ncimdevice names.Note: Must be associated withchildTypes for ART, QoS relatedmetrics.







time No N/A Specific time values are asfollows:

v last-hour

v last-day

v last-week

v last-month

v last-year


start No N/A The start time for which flowdata must be returned.

end No N/A The end time for which flow datamust be returned.


scope No


ibm-itnm

flow


childTypes No * Comma-separated list of entitytypes of nodes that must befiltered in the result. By default,it is device and interface.Supported childTypes filtervalues are as follows:

v interface

v device

v probe

v physicalcard

v artTarget

v qosQueue

v * (All)

entityResourceTypes No N/A Entity type of node that must befiltered in result. For example:

v interface

v device

v probe

v physicalcard

v artTarget

v qosQueue




Sample URLs/service/dataset/metric/lastValue?entities=ncim-217&metrics=snmpInBandwidth&start=1466008260000&end=1466011860000

/service/dataset/metric/lastValue?entities=ncim-217,ncim-218&metrics=snmpInBandwidth&time=last-hour

/service/dataset/metric/lastValue?entities=ncim-217&metrics=snmpInBandwidth&time=last-hour

/service/dataset/metric/lastValue?entities=ncim-217&metrics=snmpInBandwidth&start=1466008260000&end=1466011860000

/service/dataset/metric/lastValue?entityNames=T1 1/1,T1 1/2&metrics=snmpInBandwidth&start=1466008260000&end=1466011860000

/service/dataset/metric/lastValue?entities=ncim-217,ncim-218&metrics=snmpInBandwidth&time=last-hour

/service/dataset/metric/lastValue?metrics=snmpInBandwidth&time=lasthour&searchByProperties="PHYSICALADDRESS"=’30’ AND "LOCATION"=’KL’

/service/dataset/metric/lastValue?parents=3&metrics=snmpInBandwidth&time=lastday&childTypes=interface,device

Note:

v At least one or more of the following parameters must be provided as follows:– entities

– parents

– entityNames

– parentNames




combinations are present.v Supported operators for searchByProperties filter are as follows:




Error response

For example:{"errorMesg":"Either entities, parents, entityNames, parentNames or searchByPropertiesshould be provided"}

Response



entity number The entity that is associated with thetime and metric value

parent number The parent entity ID associated withthe entity.

entityName string The entity name. This value isdefaulted as unknown if enrichmentfails.

parentName string The parent entity name. This value isdefaulted as unknown if enrichmentfails.

MetricValue map Map of metric given in inputparameters their values.

JSON code:[

{"parent":2,"entityName":"entity1","parentName":"parent2","health":10.0,"entity":1,"cpuUsage":10.0

},{

"parent":4,"entityName":"entity2","parentName":"parent4","health":10.0,"entity":2,"cpuUsage":10.0

}]


metricsProvides a list of metrics that are available for the specified entities and timeframe.

URL

This API queries and retrieves information from the ENTITY_METRIC.RAW table.http://[host]:[port]/service/dataset/metrics

http://<myserver.ibm.com>:8081/service/dataset/metrics

Method


URL parameters


entities No N/A Comma-separated list of entityIDs


parents No N/A Comma-separated list of mainnode IDs

parentNames No N/A Comma-separated list of ncimdevice names.Note: Must be associated withchildTypes for ART, QoS relatedmetrics.





time No N/A Specific time values are asfollows:

v last-hour

v last-day

v last-week

v last-month

v last-year


start No N/A The start time for which flowdata must be returned.

end No N/A The end time for which flowdata must be returned.




scope No


ibm-itnm

flow


childTypes No * Comma-separated list of entitytypes of nodes that must befiltered in the result. By default,it is device and interface.Supported childTypes filtervalues are as follows:

v interface

v device

v probe

v physicalcard

v artTarget

v qosQueue

v * (All)


v interface

v device

v probe

v physicalcard

v artTarget

v qosQueue

parentChildRelation No union Set operation between resultfrom parent ID search and entityID search. For example,intersection, union.

Sample URLs/service/dataset/metrics?entities=ncim-217&start=1466008260000&end=1466011860000

/service/dataset/metrics?entities=ncim-217&time=last-hour

/service/dataset/metrics?entityNames=T1 1/1,T1 1/2&time=last-hour

/service/dataset/metrics?parents=3&time=last-month

/service/dataset/metrics?parents=3,1&entities=ncim-86,ncim-217&time=last-month

/service/dataset/metrics?parentNames=10.55.239.42,10.55.239.4&entityNames=T11/1&time=last-month

/service/dataset/metrics?time=last-month&="PHYSICALADDRESS"=’30’ AND "LOCATION"=’KL’

/service/dataset/metrics?parents=3&time=last-day&childTypes=interface

Note:


– parents

– entityNames


– parentNames



combinations are present.v Supported operators for searchByProperties filter are as follows:



Response



metric string The metric name

metricID long The metric ID for the associated timeand metric value.

units string Unit of measurement for the metric.For example, #, %, undef

http://<myserver.ibm.com>:8081/service/dataset/metrics?entities=12,188&time=last-day&scope=ibm-itnm

JSON code:[

{"metric":"ifInDiscards","units":"#","metricId":2118

},{

"metric":"health","units":"undef","metricId":2119

},{

"metric":"snmpInBandwidth","units":"%","metricId":2120

}]


summaryProvides a summary of the metric data.

URL

This API queries and retrieves information from ENTITY_METRIC.RAW,ENTITY_METRIC.AGG_001DAY/AGG_006HR/ AGG_030MIN tables.http://[host]:[port]/service/dataset/metric/summary

http://<myserver.ibm.com>:8081/service/dataset/metric/summary

Method


URL parameters


entities No N/A Comma-separated list of entityIDs.

entityNames No N/A Comma-separated list of entitynames.

metrics Yes N/A Comma-separated name of themetric expression that includes thetype of aggregation.

For example, snmpInBandwidth,health, max(health), min(health)

parents No N/A Comma-separated list of mainnode IDs.






start No N/A The start time for which flow datamust be returned.

end No N/A The end time for which flow datamust be returned.Note: start and end parametersmust be used together.



time No N/A Specific time values:

v last-hour

v last-day

v last-week

v last-month

v last-year


sort No N/A Metric expression that defines thesort order of the records. Only onemetric is allowed with the sortexpression. Prefix + or - toindicate sort direction.

count No -1 Number of entities summary thatmust be returned. Combined withsort provides topN or bottomNfunctions.

page No 1 The index of the page for datadisplay. This parameter issupplied with count parameter toindicate page size. By default, it is1.

excludeParent No false Flag to exclude the parent ID fromthe result. By default, thisparameter is set to False.

scope No


ibm-itnm

flow



v interface

v device

v probe

v physicalcard

v artTarget

v qosQueue

v * (All)

flatten No false Output of the result withoutnested the objects.

suppressSummary No N/A Output of the result without thesummary portion.




v interface

v device

v probe

v physicalcard

v artTarget

v qosQueue

parentChildRelation No union Set operation between the resultfrom parent identifier search andentity identifier search.


Sample URLs/service/dataset/metric/summary?entities=ncim-217&metrics=snmpInBandwidth&start=1466008260000&end=1466011860000

/service/dataset/metric/summary?entities=ncim-217,ncim-218&metrics=snmpInBandwidth&time=last-hour

/service/dataset/metric/summary?entities=ncim-217&metrics=snmpInBandwidth&time=last-hour

/service/dataset/metric/summary?entities=ncim-217&metrics=snmpInBandwidth&start=1466008260000&end=1466011860000

/service/dataset/metric/summary?entityNames=T1 1/1,T1 1/2&metrics=snmpInBandwidth&start=1466008260000&end=1466011860000

/service/dataset/metric/summary?parents=3&metrics=max(health),min(health),avg(health),sum(health),count(health)&time=last-month

/service/dataset/metric/summary?parents=3,4&entities=ncim-217,ncim-218&metrics=max(health),min(health),avg(health),sum(health),count(health)&time=last-month

/service/dataset/metric/summary?parents=3,4&entities=ncim-217,ncim-218&metrics=max(health),min(health),avg(health),sum(health),count(health)&time=last-month&sort=-sum(health)

/service/dataset/metric/summary?parents=3,4&entities=ncim-217,ncim-218&metrics=max(health),min(health),avg(health),sum(health),count(health)&time=last-month&sort=-sum(health)&count=10

/service/dataset/metric/summary?parentNames=10.55.239.42,10.55.239.4&entityNames=T11/1&metrics=max(health),min(health),avg(health),sum(health),count(health)&time=last-month&sort=-sum(health)&count=10

/service/dataset/metric/summary?entities=ncim-217,ncim-218&metrics=snmpInBandwidth&time=lasthour&page=2&count=10

/service/dataset/metric/summary?metrics=snmpInBandwidth&time=last-hour&page=2&count=10&searchByProperties="PHYSICALADDRESS"=’30’ AND "LOCATION"=’KL’

/service/dataset/metric/summary?parents=3&metrics=snmpInBandwidth&time=lastday&childTypes=interface,device/service/dataset/metric/summary?metrics=ifInDiscards&time=last-hour&entityResourceType=interface

/service/dataset/metric/summary?entities=ncim-138&metrics=max(ifInDiscards),sum(health),count(health)&time=last-hour&flatten=true

/service/dataset/metric/summary?entities=ncim-135&metrics=count(health)&time=lasthour&suppressSummary=true

/service/dataset/metric/summary?entities=ncim-138&metrics=max(ifInDiscards),sum(snmpInBandwidth),count(ifOutErrors)&time=lasthour&suppressSummary=false

/service/dataset/metric/summary?entities=ncim-135&metrics=count(health)&time=lasthour&parentChildRelation=[union/intersection]

Note:



– parents

– entityNames

– parentNames



v time or a combination of start AND or OR end must be provided.v The start and end parameters must be used together. The time parameter

supersedes start and end if they are all present in the URL.v Supported operators for properties filter are as follows:

– ,– =– <>– IN– LIKE– AND– ORFor example:properties="IFADMINSTATUS"=’"up" AND "If"="897"properties="sysName"=’"10.55.239.40" AND "If" IN ("897","898")’properties="sysName" like ’"10.55.239.%25" AND "If"="897"

Note: “%” is reserved keyword. It must be encoded with %25.v count must be provided with sort.v metric used in the sort parameter must be in one of the expressions that is used

in metrics parameter.v When sort is not provided, output is sorted by entities and rank is shown as

zero.

Error response

For example:{"errorMesg":"Either entities, parents, entityNames, parentNames, entityResourceType orsearchByProperties should be provided"}{"errorMesg": "Invalid start, end and granularity combination. Granularity : 1 minute StartMs :1568373360000 endMs : 1468375200000"}

Response



total number Total number of records available

page number Current page number

count number Number of records in the page

items list List of metric values. The entity that isassociated with the time and metricvalue.



entity number The entity that is associated with thetime and metric value.

parent number The entity that is associated with thetime and metric value.

entityName string The parent entity ID that is associatedwith the entity.

parentName string Parent entity name. This value isdefaulted to unknown, if enrichmentfails.

scope string Scope of the resource. For example,ibm-itnm or flow.

startTimestamp number The start time that is associated withthe metric value.

endTimestamp number The end time that is associated withthe metric value.

rank number The rank (1-N) of the record relative toall other entities based on sort.Defaults to 0 if sort parameter is notprovided.

metricValues list The list metric names and their values.

metric string The metric expression for theassociated time and metric value.

metricId long The metric ID for the associated timeand metric value.

value number The metric value for the associatedtime, entity, and metric expression.

inIfId number In interface IDs for given entities ifenriched.

outIfId number Out interface IDs for given entities ifenriched.

JSON code without suppressSummary flag set:{

"total":27,"page":1,"count":27,"items":[

{"entity":59,"scope":"ibm-itnm","startTimestamp":1469515500000,"endTimestamp":1469615500000,"rank":1,"metricValues":[

{"metric":"min(health)","metricId":2118,"value":0

},{

"metric":"max(health)","metricId":2118,"value":54

},


{"metric":"avg(health)","metricId":2118,"value":50

},{

"metric":"avg(snmpInBandwidth)","metricId":2119,"value":150

}]

},{

"entity":61,"scope":"ibm-itnm","startTimestamp":1469515500000,"endTimestamp":1469615500000,"rank":2,"metricValues":[


},{


},{

"metric":"avg(health)","metricId":2118,"value":50

},{

"metric":"avg(snmpInBandwidth)","metricId":2119,"value":150

}]

}]

}

JSON code with suppressSummary flag set:[

{"entity":59,"scope":"ibm-itnm","startTimestamp":1469515500000,"endTimestamp":1469615500000,"rank":1,"metricValues":[


},{


}]

}]


JSON code with flatten and suppressSummary flags set:{

"total":27,"page":1,"count":27,"items":[

{"entity":59,"scope":"ibm-itnm","startTimestamp":1469515500000,"endTimestamp":1469615500000,"rank":1,"min(health)":0,"max(health)":54,"avg(health)":50,"avg(snmpInBandwidth)":150

},{

"entity":61,"scope":"ibm-itnm","startTimestamp":1469515500000,"endTimestamp":1469615500000,"rank":2,"min(health)":54,"avg(health)":50,"avg(snmpInBandwidth)":150

}]

}

JSON code with flatten and flag set:[

{"entity":59,"scope":"ibm-itnm","startTimestamp":1469515500000,"endTimestamp":1469615500000,"rank":1,"min(health)":0,"max(health)":54

},{

"entity":61,"scope":"ibm-itnm","startTimestamp":1469515500000,"endTimestamp":1469615500000,"rank":2,"min(health)":54,"avg(health)":50,"avg(snmpInBandwidth)":150

}]


timeseriesProvides timeseries entity metric data.

URL

This API queries and retrieves information from ENTITY_METRIC.RAW,ENTITY_METRIC.AGG_001DAY/AGG_006HR/ AGG_030MIN tables.http://[host]:[port]/service/dataset/metric/timeseries

http://<myserver.ibm.com>:8081/service/dataset/metric/timeseries?entities=ncim-348&metrics=ifInDiscards&time=last-hour

Method


URL parameters


entities No N/A Comma-separated list of entityIDs.

entityNames No N/A Comma-separated list of entitynames.

metrics Yes N/A Comma-separated list of metricsand their aggregation.

For example, snmpInBandwidth,health, max(health), min(health)

parents No N/A Comma-separated list of mainnode ID.






start No N/A The start time for which flow datamust be returned.

end No N/A The end time for which flow datamust be returned.

time No N/A The name of the time short cut.For example:

v last-hour

v last-day

v last-week

v last-month

v last-year



granularity No N/A The granularity for which the datamust be aggregated. The defaultgranularity can be as follows:

v 1-minute

v 15-minute

v 30-minute

v 1-day

v 7-day

scope No


ibm-itnm

flow


sort No N/A An expression that defines thesort order of the records. Prefix +or - to indicate sort direction. Forexample, +metric -upper_limitindicates that the sorting must beby metric in ascending order, andthen by upper_limit indescending order.


v interface

v device

v probe

v physicalcard

v artTarget

v qosQueue

v * (All)

excludeParent No N/A Flag to exclude the parent IDfrom the result. By default, thisparameter is set to False.

flatten No false Output of the result withoutnested the objects.


v interface

v device

v probe

v physicalcard

v artTarget

v qosQueue




Sample URLs/service/dataset/metric/timeseries?entities=ncim-217&metrics=snmpInBandwidth&start=1466008260000&end=1466011860000

/service/dataset/metric/timeseries?entities=ncim-217&metrics=snmpInBandwidth&time=last-hour

/service/dataset/metric/timeseries?entities=ncim-217&metrics=snmpInBandwidth&time=lasthour&granularity=5-min

/service/dataset/metric/timeseries?entities=ncim-217&metrics=snmpInBandwidth&start=1466008260000&end=1466011860000&granularity=30-min

/service/dataset/metric/timeseries?entityNames=T1 1/1,T1 1/2&metrics=snmpInBandwidth&start=1466008260000&end=1466011860000&granularity=30-min

/service/dataset/metric/timeseries?parents=3&metrics=max(health),min(health),avg(health),sum(health),count(health)&time=last-month&granularity=30-min

/service/dataset/metric/timeseries?parents=3&entities=ncim-86&metrics=max(health),min(health),avg(health),sum(health),count(health)&time=last-month

/service/dataset/metric/timeseries?parentNames=10.55.239.42,10.55.239.4&entityNames=T11/1&metrics=max(health),min(health),avg(health),sum(health),count(health)&time=last-month

/service/dataset/metric/timeseries?metrics=max(health),min(health),avg(health),sum(health),count(health)&time=last-month&serachByProperties="PHYSICALADDRESS"=’30’ AND "LOCATION"=’KL’

/service/dataset/metric/timeseries?parents=3&metrics=snmpInBandwidth&time=lastday&childTypes=interface,device

Note:


– parents

– entityNames

– parentNames



v time or a combination of start and end or start or end must be provided.v Sort by metric, entitities, and timestamp are only supported.v The start and end parameters must be used together. The time parameter

supersedes start and end if they are all present in the URL.v time parameter is superseded by combination of start AND or OR end.v Supported operators for properties filter are as follows:

– ,– =– <>– IN– LIKE– AND– ORFor example:


searchByProperties="sysName"=’"10.55.239.40"’ AND "If"=’897’searchByProperties="sysName"=’"10.55.239.40"’ AND "If" IN (’897’,’898’)searchByProperties="sysName" like ’"10.55.239.%25"’ AND "If"=’897’

Note: “%” is reserved keyword. It must be encoded with %25.v If granularity is not provided, it is computed as follows:

– If time range is <= 3 hours, granularity = 1 minute.– If time range is >3 hour and <=12 hour, granularity = 15 minutes.– If time range is >12 hour and <=7 days, granularity = 30 minutes.– If time range is between 7 and <90 days, granularity = 1 day.– If time range is >=90 days, granularity = 7days.

v When the parents or parentNames and entities or entityNames are used in thesame URL and the parentChildRelation I is equal to intersection, the result isrelated to the specific parent and entity. By default, the relation is union, anddisplays all the parents and entities.

Special behavior

When you specify a granularity period with a start and end time in your query,the API engine always returns the data from the next available round up time. Forexample, if you give a query as follows:http://<myserver.ibm.com>:8081/service/dataset/metric/timeseries?entities=43064,188&metrics=ifInDiscards&start=1497052800000&end=1497117600000&granularity=18-hours

The start time is calculated based on the aggregation round up time. For 18-hrsgranularity, the round up aggregation times for the start time of June 10, 201712:00:00 AM are:v June 9, 2017 12:00:00 PMv June 10, 2017 6:00:00 AMv June 11, 2017 12:00:00 AM

The query returns the aggregated data from next available round up time that isJune 10, 2017 6:00:00 AM and not from June 10, 2017 12:00:00 AM.

Note: This behavior is noticed with timeseries API only.

Error response

For example:{"errorMesg":"Either entities, parents, entityNames, parentNames or serachByProperties should be provided"}{"errorMesg": "Invalid start, end and granularity combination. Granularity : 1 minute StartMs : 1568373360000endMs : 1468375200000"}}

Response



entity number The entity that is associatedwith the time and metricvalue.



parent number The parent entity ID that isassociated with the entity.

entityName string The entity name. The valueis defaulted to unknown ifenrichment fails.

parentName string The entity’s parent name.The value is defaulted tounknown if enrichment fails.

scope string Scope of the resource that isibm-itnm.

metric string The metric name for theassociated time and metricvalue

metricId long The metric ID for theassociated time and metricvalue.

timestamp number The time that is associatedwith the metric value.

value number The metric value for theassociated time

JSON code without flatten parameter set:[

{"parent":6,"timestamp":1471503616000,"entityName":"0","parentName":"10.55.239.2","scope":"ibm-itnm","metric":"ifOutErrors","metricId":2118,"entity":86,"value":5398

},{

"parent":-1,"timestamp":1471501946000,"entityName":"unknown","parentName":"unknown","scope":"ibm-itnm","metric":"ifOutErrors","metricId":2118,"entity":134,"value":40

},{

"parent":8,"timestamp":1471501956000,"entityName":"T1 1/2","parentName":"10.55.239.4","scope":"ibm-itnm","metric":"ifOutErrors","metricId":2118,"entity":114,"value":0

}]


JSON code with flatten parameter set:[

{"parent":587,"timestamp":1506250800000,"scope":"ibm-itnm","entityName":"0","parentName":"10.55.239.31","AVG(ifInDiscards)":6,"entity":607,"SUM(ifInDiscards)":6

},{

"parent":587,"timestamp":1506258000000,"scope":"ibm-itnm","entityName":"0","parentName":"10.55.239.31","AVG(ifInDiscards)":6,"entity":607,"SUM(ifInDiscards)":6

}]

Threshold APIREST APIs that define entity metric Thresholds and stores Threshold definitions.

definitionRetrieves and stores the threshold definitions.

It performs the following functions:v Get all the stored threshold definitionsv Get a single definition based on an identifierv Stores a definition

URL

With this API, information is queried and retrieved fromTHRESHOLD.STATIC_DEFINITION table. It can also store a new thresholddefinition in the table.http://[host]:[port]/service/dataset/threshold/definition

http://<myserver.ibm.com>:8081/service/dataset/threshold/definition

Method

The supported request type.HTTP GETHTTP POST/PUT

URL parameters


query No Provides a query predicate, which is a filter that isapplied to a where clause.

fields No Specifies the wanted fields in the response



count No Specifies the wanted maximum number of rows inthe response

sort No How the records must be sorted. Prefix + or - toindicate sort direction. For example, +metric,-upper_limit indicates to sort by metric inascending order, and then sort by upper_limit indescending order.

Sample URL

Get Allhttp://<myserver.ibm.com>:8081/service/dataset/threshold/definition

Get one (Query by an identifier)http://<myserver.ibm.com>:8081/service/dataset/threshold/definition?query=threshold_id=2

Post or Puthttp://<myserver.ibm.com>:8081/service/dataset/threshold/definition

Response


Name Data type Description Example

metric string The metric name snmpInBandwidth

effective_time_stamp long Most recent timewhen the staticdefinition is stored orupdated.

UNIX epoch timewith millisecondprecision

threshold_id long Unique identifier forthe thresholddefinition

2Important: Whenyou post a thersholddefinition for IP SLAdata, alwaysuse threshold_id =0.

enabled boolean Indicates whether thethreshold definitionis active or not.

true or false

limit_type int How the staticthreshold ranges areto be applied.

v 0 is Over

v 1 is Under

v 2 is Band

upper_limit long Upper range limit 1000

lower_limit long Lower range limit 100

num_events int Number ofconsecutiveoccurrences that arerequired to violate athreshold.

4

Get response


[{

"metric":"snmpInBandwidth","effective_time_stamp":1469199999999,"threshold_id":1,"enabled":true,"limit_type":2,"upper_limit":400000,"lower_limit":330000,"num_events":5

},{

"metric":"snmpOutBandwidth","effective_time_stamp":1469199999999,"threshold_id":2,"enabled":true,"limit_type":2,"upper_limit":400000,"lower_limit":330000,"num_events":5

},{

"metric":"ifInErrors","effective_time_stamp":1469199999999,"threshold_id":3,"enabled":true,"limit_type":0,"upper_limit":1000,"lower_limit":250,"num_events":2

},{

"metric":"ifOutErrors","effective_time_stamp":1469199999999,"threshold_id":4,"enabled":true,"limit_type":0,"upper_limit":200,"lower_limit":50,"num_events":2

}]

Payload for Post{

"metric":"snmpInBandwidth","effective_time_stamp":1469199999999,"threshold_id":2,"enabled":true,"limit_type":2,"upper_limit":400000,"lower_limit":330000,"num_events":6

}

Payload for Post for IP SLA data{"metric":"httpRtt,

"effective_time_stamp":1470275112000,"threshold_id":0,"enabled":true,"limit_type":2,"upper_limit":50,"lower_limit":10,"num_events":2

}


Attention: The threshold_id must be a unique number for that metric. Check theTHRESHOLD.STATIC_DEFINITION table for the existing threshold IDs. If you donot specify a unique ID the existing metric with the same ID is updated and thenew threshold definition is not created for the metric.



Chapter 2. Command line interface

Provide command-line interfaces that are available in IBM Network PerformanceInsight to support installation, configuration, administration, and other tasks.

A list of commands available for Network Performance Insight users andadministrators.

basecamp-manager-cmd command referenceUsage for the basecamp-manager-cmd command. The basecamp-manager-cmdcommand is available after the Fix Pack 1 is applied. Run the basecamp-manager-cmd command to start, stop, and check the status of Network Performance Insightservices.

Location

Note: basecamp-manager-cmd command can be run as netcool or a non-root userwith sudo permissions to control Network Performance Insight services.

<basecamp_Home>/basecamp-manager/bin

<basecamp_Home> is the location where the generic basecamp packages are installed.For example, /opt/IBM/basecamp.

basecamp-manager-cmd command syntax

►► basecamp-manager-cmd action stop service npi-formula hoststart npi-thresholdstatus npi-event

npi-snmp-collectornpi-itnm-collectornpi-flow-collectornpi-flow-analyticsnpi-entity-analyticsnpi-dns

►◄

basecamp-manager-cmd {action[stop|start|status] | -service <service_name> |-host <hostname>}

Parameters

serviceSpecify the name of the service. For example:v npi-formula

v npi-threshold

v npi-event

v npi-snmp-collector

v npi-flow-analytics

v npi-itnm-collector

v npi-flow-collector

v npi-dns


hostFully qualified host name (FQDN) where the service is located.

actionstop

Stops the specified service.

startStart the specified service.

statusChecks the status of the specified service.

Note: You can check the status only when the Manager Service is up andrunning.

For example:

To start the Flow Collector Service:/opt/IBM/basecamp/basecamp-manager/bin/basecamp-manager-cmd -service npi-flow-collector -host <myserver.ibm.com> start

To display the status of all services on all hosts:/opt/IBM/basecamp/basecamp-manager/bin/basecamp-manager-cmd status

To display the status of all services on a particular host as non-root user:sudo /opt/IBM/basecamp/basecamp-manager/bin/basecamp-manager-cmd -host <myserver.ibm.com> status

backup command referenceUsage for the backup command. Run the backup command to back up NetworkPerformance Insight storage database. Starting from Fix Pack 1, the backupcommand location is changed.

Location

Note: backup command can be run as root or netcool user with sudo permissionsto control Network Performance Insight services.

<basecamp_Home>/basecamp-storage/bin

<basecamp_Home> is the location where the basecamp packages are installed. Forexample, /opt/IBM/basecamp.

backup command syntax

►► backuppath

toolhelp

►◄

backup {-path <local directory>|-tool <backup tool script location> |-help}

Parameters

pathThe directory path of where the backup tar files are stored.


toolThe full path of where the Customized_script is located. For example:<basecamp_Home>/basecamp-storage/bin/directory/Customized_script

By default, this option uses the <basecamp_Home>/basecamp-storage/bin/backup-tool script to create tar files to the path specified in -path.

helpDisplays the usage for backup command.

restore command referenceUsage for the restore command. Run the restore command to restore NetworkPerformance Insight storage database. Starting from Fix Pack 1, the restorecommand location is changed.

Location

Note: restore command can be run as root or netcool user with sudo permissionsto control Network Performance Insight services.

<basecamp_Home>/basecamp-storage/bin

<basecamp_Home> is the location where Network Performance Insight is installed.For example, /opt/IBM/basecamp.

restore command syntax

►► restorelocalBackuphelp

►◄

restore {-localBackup <backup tarball location> | -help}

Parameters

-localBackupThe directory path of where the backup tar files to be restored from.

-helpDisplays the usage for restore command.

Chapter 2. Command line interface 65


Chapter 3. NetFlow versions

NetFlow technology can collect IP network traffic as it enters or exits an interface.

NetFlow enabled devices can export IP traffic statistics from all interfaces asNetFlow records to be collected by one or more associated NetFlow collectors.

The device emits a flow record when it determines that the Flow is finished byusing Flow aging, that is, when the device sees new traffic for an existing Flow, itresets the aging counter. The aging counter is determined by Flow active andinactive timeout. Typically, NetFlow records are exported by using UDP. Somemodern implementations of NetFlow use the Stream Control Transmission Protocol(SCTP) to export packets to provide some protection against packet loss, and tomake sure that NetFlow v9 templates are received before any related record isexported.

The different Flow versions that are supported in Netcool Operations Insight suchas:v NetFlow V1

First implementation of Cisco, which is now obsolete, and restricted to IPv4only.

v NetFlow V5Most common version, available on many routers from different brands.

v NetFlow V9Template-based Flow. Mostly used to report Flows like IPv6, MPLS, or evenplain IPv4 with BGP nexthop.

v IPFIXBased on the NetFlow Version 9 implementation, IPFIX is on the IETF standardsand can be implemented by multiple vendors.

NetFlow V1 formatsV1 format is the original format that is supported in the initial NetFlow releases.

V1 header format

Bytes Contents Description

0-1 version NetFlow export formatversion number

2-3 count Number of flows that areexported in this packet (1-24)

4-7 SysUptime Current time in millisecondssince the export device isstarted

8-11 unix_secs Current count of secondssince 0000 CoordinatedUniversal Time 1970

12-16 unix_nsecs Residual nanoseconds since0000 Coordinated UniversalTime 1970


V1 Flow record format

Bytes Contents Description

0-3 srcaddr Source IP address

4-7 dstaddr Destination IP address

8-11 nexthop IP address of next hop router

12-13 input SNMP index of inputinterface

14-15 output SNMP index of outputinterface

16-19 dPkts Packets in the flow

20-23 dOctets Total number of Layer 3bytes in the packets of theflow

24-27 First SysUptime at start of flow

28-31 Last SysUptime at the time thelast packet of the flow wasreceived

32-33 srcport TCP/UDP source portnumber or equivalent

34-35 dstport TCP/UDP destination portnumber or equivalent

36-37 pad1 Unused (zero) byte

38 prot IP protocol type (forexample, TCP = 6; UDP = 17)

39 tos IP type of service (ToS)

40 flags Cumulative OR of TCP flags

41-43 pad1pad2pad3

Unused (zero) bytes

44-48 Reserved Unused (zero) bytes


NetFlow Export Datagram Format

NetFlow V5 formatsV5 format is an enhancement that adds Border Gateway Protocol (BGP)autonomous system information and flow sequence numbers.

V5 header format

Bytes Fields Description

0-1 version NetFlow export formatversion number

2-3 count Number of flows that areexported in this packet (1-30)


http://www.cisco.com/c/en/us/td/docs/net_mgmt/netflow_collection_engine/3-6/user/guide/format.html


4-7 SysUptime Current time in millisecondssince the export devicestarted

8-11 unix_secs Current count of secondssince 0000 CoordinatedUniversal Time 1970

12-15 unix_nsecs Residual nanoseconds since0000 Coordinated UniversalTime 1970

16-19 flow_sequence Sequence counter of totalflows seen

20 engine_type Type of flow-switchingengine

21 engine_id Slot number of theflow-switching engine

22-23 sampling_interval First two bits hold thesampling mode; remaining14 bits hold value ofsampling interval

V5 Flow record format


0-3 srcaddr Source IP address

4-7 dstaddr Destination IP address

8-11 nexthop IP address of next hop router

12-13 input SNMP index of inputinterface

14-15 output SNMP index of outputinterface

16-19 dPkts Packets in the flow

20-23 dOctets Total number of Layer 3bytes in the packets of theflow

24-27 First SysUptime at start of flow

28-31 Last SysUptime at the time thelast packet of the flow wasreceived

32-33 srcport TCP/UDP source portnumber or equivalent

34-35 dstport TCP/UDP destination portnumber or equivalent

36 pad1 Unused (zero) byte

37 tcp_flags Cumulative OR of TCP flags

38 prot IP protocol type (forexample, TCP = 6; UDP = 17)

39 tos IP type of service (ToS)

Chapter 3. NetFlow versions 69


40-41 src_as Autonomous system numberof the source, either origin orpeer

42-43 dst_as Autonomous system numberof the destination, eitherorigin or peer

44 src_mask Source address prefix maskbits

45 dst_mask Destination address prefixmask bits

46-47 pad2 Unused (zero) bytes


NetFlow Export Datagram Format

V9 field type definitionsWhen extensibility is required, the new field types can be added to the list. Thenew field types must be updated on the Exporter and Collector but the NetFlowexport format remains unchanged.

Field Type Value Length (bytes) Description

IN_BYTES 1 N (default is 4)Incoming counter with length N x8 bits for number of bytesassociated with an IP Flow.

IN_PKTS 2 N (default is 4)

Incoming counter with length N x8 bits for the number of packetsthat are associated with an IPFlow

FLOWS 3 NNumber of flows that areaggregated; default for N is 4

PROTOCOL 4 1 IP protocol byte

SRC_TOS 5 1Type of Service byte setting whenthere is an incoming interface

TCP_FLAGS 6 1Cumulative of all the TCP flagsseen for this flow

L4_SRC_PORT 7 2TCP/UDP source port number.That is, FTP, Telnet, or equivalent

IPV4_SRC_ADDR 8 4 IPv4 source address

SRC_MASK 9 1

The number of contiguous bits inthe source address subnet mask.That is, the submask in slashnotation

INPUT_SNMP 10 NInput interface index; default forN is 2 but higher values might beused

L4_DST_PORT 11 2TCP/UDP destination portnumber. That is, FTP, Telnet, orequivalent

IPV4_DST_ADDR 12 4 IPv4 destination address


http://www.cisco.com/c/en/us/td/docs/net_mgmt/netflow_collection_engine/3-6/user/guide/format.html


DST_MASK 13 1

The number of contiguous bits inthe destination address subnetmask. That is, the submask inslash notation.

OUTPUT_SNMP 14 NOutput interface index; default forN is 2 but higher values might beused

IPV4_NEXT_HOP 15 4 IPv4 address of next-hop router

SRC_AS 16 N (default is 2)Source BGP autonomous systemnumber where N might be 2 or 4

DST_AS 17 N (default is 2)Destination BGP autonomoussystem number where N might be2 or 4

BGP_IPV4_NEXT_HOP 18 4Next-hop router's IP in the BGPdomain

MUL_DST_PKTS 19 N (default is 4)

IP multicast outgoing packetcounter with length N x 8 bits forpackets that are associated withthe IP Flow

MUL_DST_BYTES 20 N (default is 4)IP multicast outgoing byte counterwith length N x 8 bits for bytesassociated with the IP Flow

LAST_SWITCHED 21 4System uptime at which the lastpacket of this flow was switched

FIRST_SWITCHED 22 4System uptime at which the firstpacket of this flow was switched

OUT_BYTES 23 N (default is 4)Outgoing counter with length N x8 bits for the number of bytesassociated with an IP Flow

OUT_PKTS 24 N (default is 4)

Outgoing counter with length N x8 bits for the number of packetsthat are associated with an IPFlow.

MIN_PKT_LNGTH 25 2Minimum IP packet length onincoming packets of the flow

MAX_PKT_LNGTH 26 2Maximum IP packet length onincoming packets of the flow

IPV6_SRC_ADDR 27 16 IPv6 Source Address

IPV6_DST_ADDR 28 16 IPv6 Destination Address

IPV6_SRC_MASK 29 1Length of the IPv6 source mask incontiguous bits

IPV6_DST_MASK 30 1Length of the IPv6 destinationmask in contiguous bits

IPV6_FLOW_LABEL 31 3IPv6 flow label as in RFC 2460definition

ICMP_TYPE 32 2Internet Control Message Protocol(ICMP) packet type; reported as((ICMP Type*256) + ICMP code)

MUL_IGMP_TYPE 33 1Internet Group ManagementProtocol (IGMP) packet type



SAMPLING_INTERVAL 34 4

During the use of sampledNetFlow, the rate at which packetsare sampled. That is, a value of100 indicates that one of every 100packets is sampled

SAMPLING_ALGORITHM 35 1

The type of algorithm that is usedfor sampled NetFlow: 0x01Deterministic Sampling, 0x02Random Sampling

FLOW_ACTIVE_TIMEOUT 36 2Timeout value (in seconds) foractive flow entries in the NetFlowcache

FLOW_INACTIVE_TIMEOUT 37 2Timeout value (in seconds) forinactive flow entries in theNetFlow cache

ENGINE_TYPE 38 1Type of flow switching engine: RP= 0, VIP/Linecard = 1

ENGINE_ID 39 1ID number of the flow switchingengine

TOTAL_BYTES_EXP 40 N (default is 4)

Counter with length N x 8 bits forbytes for the number of bytesexported by the ObservationDomain

TOTAL_PKTS_EXP 41 N (default is 4)

Counter with length N x 8 bits forbytes for the number of packetsthat are exported by theObservation Domain

TOTAL_FLOWS_EXP 42 N (default is 4)

Counter with length N x 8 bits forbytes for the number of flows thatare exported by the ObservationDomain

*Vendor Proprietary* 43

IPV4_SRC_PREFIX 44 4IPv4 source address prefix(specific for Catalyst architecture)

IPV4_DST_PREFIX 45 4IPv4 destination address prefix(specific for Catalyst architecture)

MPLS_TOP_LABEL_TYPE 46 1

MPLS Top Label Type: 0x00UNKNOWN 0x01 TE-MIDPT 0x02ATOM 0x03 VPN 0x04 BGP 0x05LDP

MPLS_TOP_LABEL_IP_ADDR 47 4Forwarding Equivalent Classcorresponding to the MPLS TopLabel

FLOW_SAMPLER_ID 48 1Identifier that is shown in "showflow-sampler"

FLOW_SAMPLER_MODE 49 1

The type of algorithm that is usedfor sampling data: 0x02 randomsampling. Use withFLOW_SAMPLER_MODE

FLOW_SAMPLER_RANDOM_INTERVAL50 4Packet interval at which tosample. Use withFLOW_SAMPLER_MODE



*Vendor Proprietary* 51

MIN_TTL 52 1Minimum TTL on incomingpackets of the flow

MAX_TTL 53 1Maximum TTL on incomingpackets of the flow

IPV4_IDENT 54 2 The IP v4 that identifies field

DST_TOS 55 1Type of Service byte setting whenexiting outgoing interface

IN_SRC_MAC 56 6 Incoming source MAC address

OUT_DST_MAC 57 6Outgoing destination MACaddress

SRC_VLAN 58 2Virtual LAN identifier that isassociated with ingress interface

DST_VLAN 59 2Virtual LAN identifier that isassociated with egress interface

IP_PROTOCOL_VERSION 60 1

Internet Protocol version is set to4 for IPv4, and set to 6 for IPv6. Ifnot present in the template, thenversion 4 is assumed.

DIRECTION 61 1Flow direction: 0 - ingress flow, 1- egress flow

IPV6_NEXT_HOP 62 16IPv6 address of the next-hoprouter

BPG_IPV6_NEXT_HOP 63 16Next-hop router in the BGPdomain

IPV6_OPTION_HEADERS 64 4Bit-encoded field that identifiesIPv6 option headers found in theflow

Vendor Proprietary 65





MPLS_LABEL_1 70 3

MPLS label at position 1 in thestack. It comprises 20 bits ofMPLS label, 3 EXP (experimental)bits and 1 S (end-of-stack) bit.

MPLS_LABEL_2 71 3


MPLS_LABEL_3 72 3


MPLS_LABEL_4 73 3




MPLS_LABEL_5 74 3


MPLS_LABEL_6 75 3


MPLS_LABEL_7 76 3


MPLS_LABEL_8 77 3


MPLS_LABEL_9 78 3


MPLS_LABEL_10 79 3


IN_DST_MAC 80 6Incoming destination MACaddress

OUT_SRC_MAC 81 6 Outgoing source MAC address

IF_NAME 82

N

Shortened interface name, FE1/0(default that isspecified intemplate)

IF_DESC 83N (default thatis specified intemplate)

Full interface name, FastEthernet1/0

SAMPLER_NAME 84N (default thatis specified intemplate)

Name of the flow sampler

IN_ PERMANENT _BYTES 85 N (default is 4)Running byte counter for apermanent flow

IN_ PERMANENT _PKTS 86 N (default is 4)Running packet counter for apermanent flow

* Vendor Proprietary* 87

FRAGMENT_OFFSET 88 2The fragment-offset value fromfragmented IP packets



FORWARDING STATUS 89 1

Forwarding status is encoded on 1byte with the 2 left bits giving thestatus and the 6 remaining bitsgiving the reason code.

Status is either unknown (00),Forwarded (10), Dropped (10) orConsumed (11). List of forwardingstatus values with their meanings:

v Unknown

– 0

v Forwarded

– Unknown 64

– Forwarded Fragmented 65

– Forwarded not Fragmented66

v Dropped

– Unknown 128

– Drop ACL Deny 129

– Drop ACL drop 130

– Drop Unroutable 131

– Drop Adjacency 132

– Drop Fragmentation and DFset 133

– Drop Bad header checksum134

– Drop Bad total Length 135

– Drop Bad Header Length 136

– Drop bad TTL 137

– Drop Policer 138

– Drop WRED 139

– Drop RPF 140

– Drop For us 141

– Drop Bad output interface142

– Drop Hardware 143

v Consumed

– Unknown 192

– Terminate Punt Adjacency193

– Terminate IncompleteAdjacency 194

– Terminate For us 195

MPLS PAL RD 90 8 (array) MPLS PAL Route Distinguisher.



MPLS PREFIX LEN 91 1Number of consecutive bits in theMPLS prefix length.

SRC TRAFFIC INDEX 92 4BGP Policy Accounting SourceTraffic Index

DST TRAFFIC INDEX 93 4BGP Policy AccountingDestination Traffic Index

APPLICATION DESCRIPTION 94 N Application description.

APPLICATION TAG 95 1+n8 bits of engine ID, followed by nbits of classification.

APPLICATION NAME 96 NName that is associated with aclassification.

postipDiffServCodePoint 98 1

The value of a DifferentiatedServices Code Point (DSCP)encoded in the DifferentiatedServices field after modification.

replication factor 99 4 Multicast replication factor.

DEPRECATED 100 N DEPRECATED

layer2packetSectionOffset 102Layer 2 packet section offset.Potentially a generic offset.

layer2packetSectionSize 103Layer 2 packet section size.Potentially a generic size.

layer2packetSectionData 104 Layer 2 packet section data.

105 - 127 Reserved for future use by cisco


NetFlow Version 9 Flow-Record Format

Normalized Flow record fields in Network Performance InsightA list of normalized flow fields that are used with a common label across all flowformats and applicable for all vendors and protocols.

When you enable the configuration setting as described in Enabling additional Flowraw fields collection section in Installing and Configuring IBM Network PerformanceInsight to collect all Flow fields, all the fields that are specified in the table arecollected. The list of Flow fields that are stored in the database is specified inDefault normalized flow record fields in Network Performance Insight section in IBMNetwork Performance Insight: Product Overview. The remaining Flow fields are storedin Hadoop file system and can be read by using an Apache Parquet reader.

Normalized Flow Fields V9 Field name IPFIX field name

inOctets 1(IN_BYTES) 1(octetDeltaCount)

inPackets 2(IN_PKTS) 2(packetDeltaCount)

deltaFlowCount 3(FLOWS) 3(deltaFlowCount)

protocolId 4(PROTOCOL) 4(protocolIdentifier)

srcTos 5(SRC_TOS) 5(ipClassOfService)

tcpBits 6(TCP_FLAGS) 6(tcpControlBits)

srcPort 7(L4_SRC_PORT) 7(sourceTransportPort)


http://www.cisco.com/en/US/technologies/tk648/tk362/technologies_white_paper09186a00800a3db9.html


srcIp 8(IPV4_SRC_ADDR) 8(sourceIPv4Address)

srcMask 9(SRC_MASK) 9(sourceIPv4PrefixLength)

inIfId 10(INPUT_SNMP) 10(ingressInterface)

dstPort 11(L4_DST_PORT) 11(destinationTransportPort)

dstIp 12(IPV4_DST_ADDR) 12(destinationIPv4Address)

dstMask 13(DST_MASK) 13(destinationIPv4PrefixLength)

outIfId 14(OUTPUT_SNMP) 14(egressInterface)

nextHopIp 15(IPV4_NEXT_HOP) 15(ipNextHopIPv4Address)

bgpSrcAsNum 16(SRC_AS) 16(bgpSourceAsNumber)

bgpDstAsNum 17(DST_AS) 17(bgpDestinationAsNumber)

bgpNextHopIp 18(BGP_IPV4_NEXT_HOP) 18(bgpNextHopIPv4Address)

postMCastPacketDeltaCount MUL_DST_PKTS 19(postMCastPacketDeltaCount)

postMCastOctetDeltaCount MUL_DST_BYTES 20(postMCastOctetDeltaCount)

endMs =baseTimestamp+21(LAST_SWITCHED) 21(flowEndSysUpTime)

startMs =baseTimestamp+22(FIRST_SWITCHED)22(flowStartSysUpTime)

outOctets 23(OUT_BYTES) 23(postOctetDeltaCount)

outPackets 24(OUT_PKTS) 24(postPacketDeltaCount)

minimumIpTotalLength MIN_PKT_LNGTH 25(minimumIpTotalLength)

maximumIpTotalLength MAX_PKT_LNGTH 26(maximumIpTotalLength)

srcIp 27(IPV6_SRC_ADDR) 27(sourceIPv6Address)

dstIp (28(IPV6_DST_ADDR) 28(destinationIPv6Address)

srcMask 29(IPV6_SRC_MASK) 29(sourceIPv6PrefixLength)

dstMask 30(IPV6_DST_MASK) 30(destinationIPv6PrefixLength)

flowLabelIPv6 31(IPV6_FLOW_LABEL) 31(flowLabelIPv6)

icmpTypeCodeIPv4 32(ICMP_TYPE) 32(icmpTypeCodeIPv4)

igmpType 33(MUL_IGMP_TYPE) 33(igmpType)

samplingInterval 34(SAMPLING_INTERVAL) 34(samplingInterval)

samplingAlgorithm 35(SAMPLING_ALGORITHM) 35(samplingAlgorithm)

flowActiveTimeout 36(FLOW_ACTIVE_TIMEOUT) 36(flowActiveTimeout)

flowIdleTimeout 37(FLOW_INACTIVE_TIMEOUT) 37(flowIdleTimeout)

engineType 38(ENGINE_TYPE) 38(engineType)

engineId 39(ENGINE_ID) 39(engineId)

exportedOctetTotalCount 40(TOTAL_BYTES_EXP) 40(exportedOctetTotalCount)

exportedMessageTotalCount 41(TOTAL_PKTS_EXP) 41(exportedMessageTotalCount)

exportedFlowRecordTotalCount 42(TOTAL_FLOWS_EXP) 42(exportedFlowRecordTotalCount)

ipv4RouterSc 43(*Vendor Proprietary*) 43(ipv4RouterSc)

sourceIPv4Prefix 44(IPV4_SRC_PREFIX) 44(sourceIPv4Prefix)

destinationIPv4Prefix 45(IPV4_DST_PREFIX) 45(destinationIPv4Prefix)

mplsTopLabelType 46(MPLS_TOP_LABEL_TYPE) 46(mplsTopLabelType)

mplsTopLabelIPv4Address 47(MPLS_TOP_LABEL_IP_ADDR) 47(mplsTopLabelIPv4Address)

samplerId 48(FLOW_SAMPLER_ID) 48(samplerId)



samplerMode 49(FLOW_SAMPLER_MODE) 49(samplerMode)

samplerRandomInterval 50(FLOW_SAMPLER_RANDOM_INTERVAL)

50(flow_sampler_randomInterval)

classId 51(classId) 51(classId)

minimumTTL 52(MIN_TTL) 52(minTtl)

maximumTTL 53(MAX_TTL) 53(maxTtl)

fragmentIdentification 54(IPV4_IDENT) 54(sourceIPv6PrefixLength)

postIpClassOfService 55(DST_TOS) 55(postIpClassOfService)

sourceMacAddress 56(IN_SRC_MAC) 56(inMacAddress)

postDestinationMacAddress 57(OUT_DST_MAC) 57(postDestinationMacAddress)

vlanId 58(SRC_VLAN) 58(srcVlan)

postVlanId 59(DST_VLAN) 59(dstVlan)

ipVersion 60(IP_PROTOCOL_VERSION) 60(ipVersion)

flowDirection 61(DIRECTION) 61(direction) 61(Direction)

ipNextHopIPv6Address 62(IPV6_NEXT_HOP) 62(ipNextHopIPv6Address)

bgpNextHopAddress 63(BPG_IPV6_NEXT_HOP) 63(bgpNextHopIPv6Address)

ipv6ExtensionHeaders 64(IPV6_OPTION_HEADERS) 64(ipv6ExtensionHeaders)

custom_2 65(Vendor Proprietary) Assigned for NetFlow v9 compatibility

custom_3 66(Vendor Proprietary)




mplsTopLabelStackSection 70(MPLS_LABEL_1) 70(mplsTopLabelStackSection)

mplsLabelStackSection2 71(MPLS_LABEL_2) 71(mplsLabelStackSection2)









destinationMacAddress 80(IN_DST_MAC) 80(inMacAddress)

postSourceMacAddress 81(OUT_SRC_MAC) 81(postSourceMacAddress)

interfaceName 82(IF_NAME) 82(ifName)

interfaceDescription 83(IF_DESC) 83(ifDesc)

samplerName 84(SAMPLER_NAME) 84(samplerName)

octetTotalCount 85(IN_ PERMANENT _BYTES) 85(inTotalCount)

packetTotalCount 86(IN_ PERMANENT _PKTS) 86(inTotalCount)

flagsAndSamplerId 87(Vendor Proprietary) 87(flagsAndSamplerId)



fragmentOffset 88(FRAGMENT_OFFSET) 88(fragmentOffset)

forwardingStatus 89(FORWARDING STATUS) 89(forwarding status)

mplsVpnRouteDistinguisher 90(MPLS PAL RD) 90(mplsVpnRouteDistinguisher)

mplsTopLabelPrefixLength 91(MPLS PREFIX LEN) 91(mplsTopLabelPrefixLength)

srcTrafficIndex 92(SRC TRAFFIC INDEX) 92(src traffic index)

dstTrafficIndex 93(DST TRAFFIC INDEX) 93(dst traffic index)

unknown_1 N/A Assigned for NetFlow v9 compatibility

postIpDiffServCodePoint 98(postipDiffServCodePoint) 98(postIpDiffServCodePoint)

multicastReplicationFactor 99(replication factor) 99(replication factor)

className Deprecated 100(className)

classificationEngineId N/A 101(classificationEngineId)

layer2packetSectionOffset 102(layer2packetSectionOffset) 102(layer2packetsectionoffset)

layer2packetSectionSize 103(layer2packetSectionSize) 103(layer2packetsectionsize)

layer2packetSectionData 104(layer2packetSectionData) 104(layer2packetsectiondata)

application version 105(application version) 105(application version)

application version name 106(application version name) 106(application version name)

application vendor 107(application vendor ) 107(application vendor )

sub application name 109(sub application name) 109(sub application name)

sub application description 110(sub application description) 110(sub application description)

template parameter range end 111(template parameter range end) 111(template parameter range end)

112-127 Assigned for NetFlow V9 compatibility Assigned for NetFlow V9 compatibility

bgpNextAdjacentAsNumber 128(bgpNextAdjacentAsNumber) 128(bgpNextAdjacentAsNumber)

bgpPrevAdjacentAsNumber 129(bgpPrevAdjacentAsNumber) 129(bgpPrevAdjacentAsNumber)

exporterIPv4Address 130(exporterIPv4Address) 130(exporterIPv4Address)

exporterIPv6Address 131(exporterIPv6Address) 131(exporterIPv6Address)

droppedOctetDeltaCount 132(droppedOctetDeltaCount) 132(droppedOctetDeltaCount)

droppedPacketDeltaCount 133(droppedPacketDeltaCount) 133(droppedPacketDeltaCount)

droppedOctetTotalCount 134(droppedOctetTotalCount) 134(droppedOctetTotalCount)

droppedPacketTotalCount 135(droppedPacketTotalCount) 135(droppedPacketTotalCount)

flowEndReason 136(flowEndReason) 136(flowEndReason)

commonPropertiesId 137(commonPropertiesId) 137(commonPropertiesId)

observationPointId 138(observationPointId) 138(observationPointId)

icmpTypeCodeIPv6 139(icmpTypeCodeIPv6) 139(icmpTypeCodeIPv6)

mplsTopLabelIPv6Address 140(mplsTopLabelIPv6Address) 140(mplsTopLabelIPv6Address)

lineCardId 141(lineCardId) 141(lineCardId)

portId 142(portId) 142(portId)

meteringProcessId 143(meteringProcessId) 143(meteringProcessId)

exportingProcessId 144(exportingProcessId) 144(exportingProcessId)

templateId 145(templateId) 145(templateId)

wlanChannelId 146(wlanChannelId) 146(wlanChannelId)

wlanSSID 147(wlanSSID) 147(wlanSSID)



flowId 148(flowId) 148(flowId)

observationDomainId 149(observationDomainId) 149(observationDomainId)

flowStartSeconds 150(flowStartSeconds) 150(flowStartSeconds)

flowEndSeconds 151(flowEndSeconds) 151(flowEndSeconds)

flowStartMilliseconds 152(flowStartMilliseconds) 152(flowStartMilliseconds)

flowEndMilliseconds 153(flowEndMilliseconds) 153(flowEndMilliseconds)

flowStartMicroseconds 154(flowStartMicroseconds) 154(flowStartMicroseconds)

flowEndMicroseconds 155(flowEndMicroseconds) 155(flowEndMicroseconds)

flowStartNanoseconds 156(flowStartNanoseconds) 156(flowStartNanoseconds)

flowEndNanoseconds 157(flowEndNanoseconds) 157(flowEndNanoseconds)

flowStartDeltaMicroseconds 158(flowStartDeltaMicroseconds) 158(flowStartDeltaMicroseconds)

flowEndDeltaMicroseconds 159(flowEndDeltaMicroseconds) 159(flowEndDeltaMicroseconds)

systemInitTimeMilliseconds 160(systemInitTimeMilliseconds) 160(systemInitTimeMilliseconds)

flowDurationMilliseconds 161(flowDurationMilliseconds) 161(flowDurationMilliseconds)

flowDurationMicroseconds 162(flowDurationMicroseconds) 162(flowDurationMicroseconds)

observedFlowTotalCount 163(observedFlowTotalCount) 163(observedFlowTotalCount)

ignoredPacketTotalCount 164(ignoredPacketTotalCount) 164(ignoredPacketTotalCount)

ignoredOctetTotalCount 165(ignoredOctetTotalCount) 165(ignoredOctetTotalCount)

notSentFlowTotalCount 166(notSentFlowTotalCount) 166(notSentFlowTotalCount)

notSentPacketTotalCount 167(notSentPacketTotalCount) 167(notSentPacketTotalCount)

notSentOctetTotalCount 168(notSentOctetTotalCount) 168(notSentOctetTotalCount)

destinationIPv6Prefix 169(destinationIPv6Prefix) 169(destinationIPv6Prefix)

sourceIPv6Prefix 170(sourceIPv6Prefix) 170(sourceIPv6Prefix)

postOctetTotalCount 171(postOctetTotalCount) 171(postOctetTotalCount)

postPacketTotalCount 172(postPacketTotalCount) 172(postPacketTotalCount)

flowKeyIndicator 173(flowKeyIndicator) 173(flowKeyIndicator)

postMCastPacketTotalCount 174(postMCastPacketTotalCount) 174(postMCastPacketTotalCount)

postMCastOctetTotalCount 175(postMCastOctetTotalCount) 175(postMCastOctetTotalCount)

icmpTypeIPv4 176(icmpTypeIPv4) 176(icmpTypeIPv4)

icmpCodeIPv4 177(icmpCodeIPv4) 177(icmpCodeIPv4)

icmpTypeIPv6 178(icmpTypeIPv6) 178(icmpTypeIPv6)

icmpCodeIPv6 178(icmpTypeIPv6) 179(icmpCodeIPv6)

udpSourcePort 180(udpSourcePort) 180(udpSourcePort)

udpDestinationPort 181(udpDestinationPort) 181(udpDestinationPort)

tcpSourcePort 182(tcpSourcePort) 182(tcpSourcePort)

tcpDestinationPort 183(tcpDestinationPort) 183(tcpDestinationPort)

tcpSequenceNumber 184(tcpSequenceNumber) 184(tcpSequenceNumber)

tcpAcknowledgementNumber 185(tcpAcknowledgementNumber) 185(tcpAcknowledgementNumber)

tcpWindowSize 186(tcpWindowSize) 186(tcpWindowSize)

tcpUrgentPointer 187(tcpUrgentPointer) 187(tcpUrgentPointer)

tcpHeaderLength 188(tcpHeaderLength) 188(tcpHeaderLength)



ipHeaderLength 189(ipHeaderLength) 189(ipHeaderLength)

totalLengthIPv4 190(totalLengthIPv4) 190(totalLengthIPv4)

payloadLengthIPv6 191(payloadLengthIPv6) 191(payloadLengthIPv6)

ipTTL 192(ipTTL) 192(ipTTL)

nextHeaderIPv6 193(nextHeaderIPv6) 193(nextHeaderIPv6)

mplsPayloadLength 194(mplsPayloadLength) 194(mplsPayloadLength)

ipDiffServCodePoint 195(ipDiffServCodePoint) 195(ipDiffServCodePoint)

ipPrecedence 196(ipPrecedence) 196(ipPrecedence)

fragmentFlags 197(fragmentFlags) 197(fragmentFlags)

octetDeltaSumOfSquares 198(octetDeltaSumOfSquares) 198(octetDeltaSumOfSquares)

octetTotalSumOfSquares 199(octetTotalSumOfSquares) 199(octetTotalSumOfSquares)

mplsTopLabelTTL 200(mplsTopLabelTTL) 200(mplsTopLabelTTL)

mplsLabelStackLength 201(mplsLabelStackLength) 201(mplsLabelStackLength)

mplsLabelStackDepth 202(mplsLabelStackDepth) 202(mplsLabelStackDepth)

mplsTopLabelExp 203(mplsTopLabelExp) 203(mplsTopLabelExp)

ipPayloadLength 204(ipPayloadLength) 204(ipPayloadLength)

udpMessageLength 205(udpMessageLength) 205(udpMessageLength)

isMulticast 206(isMulticast) 206(isMulticast)

ipv4IHL 207(ipv4IHL) 207(ipv4IHL)

ipv4Options 208(ipv4Options) 208(ipv4Options)

tcpOptions 209(tcpOptions) 209(tcpOptions)

paddingOctets 210(paddingOctets) 210(paddingOctets)

collectorIPv4Address 211(collectorIPv4Address) 211(collectorIPv4Address)

collectorIPv6Address 212(collectorIPv6Address) 212(collectorIPv6Address)

exportInterface 213(exportInterface) 213(exportInterface)

exportProtocolVersion 214(exportProtocolVersion) 214(exportProtocolVersion)

exportTransportProtocol 215(exportTransportProtocol) 215(exportTransportProtocol)

collectorTransportPort 216(collectorTransportPort) 216(collectorTransportPort)

exporterTransportPort 217(exporterTransportPort) 217(exporterTransportPort)

tcpSynTotalCount 218(tcpSynTotalCount) 218(tcpSynTotalCount)

tcpFinTotalCount 219(tcpFinTotalCount) 219(tcpFinTotalCount)

tcpRstTotalCount 220(tcpRstTotalCount) 220(tcpRstTotalCount)

tcpPshTotalCount 221(tcpPshTotalCount) 221(tcpPshTotalCount)

tcpAckTotalCount 222(tcpAckTotalCount) 222(tcpAckTotalCount)

tcpUrgTotalCount 223(tcpUrgTotalCount) 223(tcpUrgTotalCount)

ipTotalLength 224(ipTotalLength) 224(ipTotalLength)

postNATSourceIPv4Address 225(postNATSourceIPv4Address) 225(postNATSourceIPv4Address)

postNATDestinationIPv4Address 226(postNATDestinationIPv4Address) 226(postNATDestinationIPv4Address)

postNAPTSourceTransportPort 227(postNAPTSourceTransportPort) 227(postNAPTSourceTransportPort)

postNAPTDestinationTransportPort 228(postNAPTDestinationTransportPort) 228(postNAPTDestinationTransportPort)

natOriginatingAddressRealm 229(natOriginatingAddressRealm) 229(natOriginatingAddressRealm)



natEvent 230(natEvent) 230(natEvent)

initiatorOctets 231(initiatorOctets) 231(initiatorOctets)

responderOctets 232(responderOctets) 232(responderOctets)

firewallEvent 233(firewallEvent) 233(firewallEvent)

ingressVRFID 234(ingressVRFID) 234(ingressVRFID)

egressVRFID 235(egressVRFID) 235(egressVRFID)

VRFname 236(VRFname) 236(VRFname)

postMplsTopLabelExp 237(postMplsTopLabelExp) 237(postMplsTopLabelExp)

tcpWindowScale 238(tcpWindowScale) 238(tcpWindowScale)

biflowDirection 239(biflowDirection) 239(biflowDirection)

ethernetHeaderLength 240(ethernetHeaderLength) 240(ethernetHeaderLength)

ethernetPayloadLength 241(ethernetPayloadLength) 241(ethernetPayloadLength)

ethernetTotalLength 242(ethernetTotalLength) 242(ethernetTotalLength)

dot1qVlanId 243(dot1qVlanId) 243(dot1qVlanId)

dot1qPriority 244(dot1qPriority) 244(dot1qPriority)

dot1qCustomerVlanId 245(dot1qCustomerVlanId) 245(dot1qCustomerVlanId)

dot1qCustomerPriority 246(dot1qCustomerPriority) 246(dot1qCustomerPriority)

metroEvcId 247(metroEvcId) 247(metroEvcId)

metroEvcType 248(metroEvcType) 248(metroEvcType)

pseudoWireId 249(pseudoWireId) 249(pseudoWireId)

pseudoWireType 250(pseudoWireType) 250(pseudoWireType)

pseudoWireControlWord 251(pseudoWireControlWord) 251(pseudoWireControlWord)

ingressPhysicalInterface 252(ingressPhysicalInterface) 252(ingressPhysicalInterface)

egressPhysicalInterface 253(egressPhysicalInterface) 253(egressPhysicalInterface)

postDot1qVlanId 254(postDot1qVlanId) 254(postDot1qVlanId)

postDot1qCustomerVlanId 255(postDot1qCustomerVlanId) 255(postDot1qCustomerVlanId)

ethernetType 256(ethernetType) 256(ethernetType)

postIpPrecedence 257(postIpPrecedence) 257(postIpPrecedence)

collectionTimeMilliseconds 258(collectionTimeMilliseconds) 258(collectionTimeMilliseconds)

exportSctpStreamId 259(exportSctpStreamId) 259(exportSctpStreamId)

maxExportSeconds 260(maxExportSeconds) 260(maxExportSeconds)

maxFlowEndSeconds 261(maxFlowEndSeconds) 261(maxFlowEndSeconds)

messageMD5Checksum 262(messageMD5Checksum) 262(messageMD5Checksum)

messageScope 263(messageScope) 263(messageScope)

minExportSeconds 264(minExportSeconds) 264(minExportSeconds)

minFlowStartSeconds 265(minFlowStartSeconds) 265(minFlowStartSeconds)

opaqueOctets 266(opaqueOctets) 266(opaqueOctets)

sessionScope 267(sessionScope) 267(sessionScope)

maxFlowEndMicroseconds 268(maxFlowEndMicroseconds) 268(maxFlowEndMicroseconds)

maxFlowEndMilliseconds 269(maxFlowEndMilliseconds) 269(maxFlowEndMilliseconds)

maxFlowEndNanoseconds 270(maxFlowEndNanoseconds) 270(maxFlowEndNanoseconds)



minFlowStartMicroseconds 271(minFlowStartMicroseconds) 271(minFlowStartMicroseconds)

minFlowStartMilliseconds 272(minFlowStartMilliseconds) 272(minFlowStartMilliseconds)

minFlowStartNanoseconds 273(minFlowStartNanoseconds) 273(minFlowStartNanoseconds)

collectorCertificate 274(collectorCertificate) 274(collectorCertificate)

exporterCertificate 275(exporterCertificate) 275(exporterCertificate)

dataRecordsReliability 276(dataRecordsReliability) 276(dataRecordsReliability)

observationPointType 277(observationPointType) 277(observationPointType)

connectionCountNew 278(connectionCountNew) 278(connectionCountNew)

connectionSumDurationSeconds 279(connectionSumDurationSeconds) 279(connectionSumDurationSeconds)

connectionTransactionId 280(connectionTransactionId) 280(connectionTransactionId)

postNATSourceIPv6Address 281(postNATSourceIPv6Address) 281(postNATSourceIPv6Address)

postNATDestinationIPv6Address 282(postNATDestinationIPv6Address) 282(postNATDestinationIPv6Address)

natPoolId 283(natPoolId) 283(natPoolId)

natPoolName 284(natPoolName) 284(natPoolName)

anonymizationFlags 285(anonymizationFlags) 285(anonymizationFlags)

anonymizationTechnique 286(anonymizationTechnique) 286(anonymizationTechnique)

informationElementIndex 287(informationElementIndex) 287(informationElementIndex)

p2pTechnology 288(p2pTechnology) 288(p2pTechnology)

tunnelTechnology 289(tunnelTechnology) 289(tunnelTechnology)

encryptedTechnology 290(encryptedTechnology) 290(encryptedTechnology)

basicList 291(basicList) 291(basicList)

subTemplateList 292(subTemplateList) 292(subTemplateList)

subTemplateMultiList 293(subTemplateMultiList) 293(subTemplateMultiList)

bgpValidityState 294(bgpValidityState) 294(bgpValidityState)

IPSecSPI 295(IPSecSPI) 295(IPSecSPI)

greKey 296(greKey) 296(greKey)

natType 297(natType) 297(natType)

initiatorPackets 298(initiatorPackets) 298(initiatorPackets)

responderPackets 299(responderPackets) 299(responderPackets)

observationDomainName 300(observationDomainName) 300(observationDomainName)

selectionSequenceId 301(selectionSequenceId) 301(selectionSequenceId)

selectorId 302(selectorId) 302(selectorId)

informationElementId 303(informationElementId) 303(informationElementId)

selectorAlgorithm 304(selectorAlgorithm) 304(selectorAlgorithm)

samplingPacketInterval 305(samplingPacketInterval) 305(samplingPacketInterval)

samplingPacketSpace 306(samplingPacketSpace) 306(samplingPacketSpace)

samplingTimeInterval 307(samplingTimeInterval) 307(samplingTimeInterval)

samplingTimeSpace 308(samplingTimeSpace) 308(samplingTimeSpace)

samplingSize 309(samplingSize) 309(samplingSize)

samplingPopulation 310(samplingPopulation) 310(samplingPopulation)

samplingProbability 311(samplingProbability) 311(samplingProbability)



dataLinkFrameSize 312(dataLinkFrameSize) 312(dataLinkFrameSize)

ipHeaderPacketSection 313(ipHeaderPacketSection) 313(ipHeaderPacketSection)

ipPayloadPacketSection 314(ipPayloadPacketSection) 314(ipPayloadPacketSection)

dataLinkFrameSection 315(dataLinkFrameSection) 315(dataLinkFrameSection)

mplsLabelStackSection 316(mplsLabelStackSection) 316(mplsLabelStackSection)

mplsPayloadPacketSection 317(mplsPayloadPacketSection) 317(mplsPayloadPacketSection)

selectorIdTotalPktsObserved 318(selectorIdTotalPktsObserved) 318(selectorIdTotalPktsObserved)

selectorIdTotalPktsSelected 319(selectorIdTotalPktsSelected) 319(selectorIdTotalPktsSelected)

absoluteError 320(absoluteError) 320(absoluteError)

relativeError 321(relativeError) 321(relativeError)

observationTimeSeconds 322(observationTimeSeconds) 322(observationTimeSeconds)

observationTimeMilliseconds 323(observationTimeMilliseconds) 323(observationTimeMilliseconds)

observationTimeMicroseconds 324(observationTimeMicroseconds) 324(observationTimeMicroseconds)

observationTimeNanoseconds 325(observationTimeNanoseconds) 325(observationTimeNanoseconds)

digestHashValue 326(digestHashValue) 326(digestHashValue)

hashIPPayloadOffset 327(hashIPPayloadOffset) 327(hashIPPayloadOffset)

hashIPPayloadSize 328(hashIPPayloadSize) 328(hashIPPayloadSize)

hashOutputRangeMin 329(hashOutputRangeMin) 329(hashOutputRangeMin)

hashOutputRangeMax 330(hashOutputRangeMax) 330(hashOutputRangeMax)

hashSelectedRangeMin 331(hashSelectedRangeMin) 331(hashSelectedRangeMin)

hashSelectedRangeMax 332(hashSelectedRangeMax) 332(hashSelectedRangeMax)

hashDigestOutput 333(hashDigestOutput) 333(hashDigestOutput)

hashInitialiserValue 334(hashInitialiserValue) 334(hashInitialiserValue)

selectorName 335(selectorName) 335(selectorName)

upperCILimit 336(upperCILimit) 336(upperCILimit)

lowerCILimit 337(lowerCILimit) 337(lowerCILimit)

confidenceLevel 338(confidenceLevel) 338(confidenceLevel)

informationElementDataType 339(informationElementDataType) 339(informationElementDataType)

informationElementDescription 340(informationElementDescription) 340(informationElementDescription)

informationElementName 341(informationElementName) 341(informationElementName)

informationElementRangeBegin 342(informationElementRangeBegin) 342(informationElementRangeBegin)

informationElementRangeEnd 343(informationElementRangeEnd) 343(informationElementRangeEnd)

informationElementSemantics 344(informationElementSemantics) 344(informationElementSemantics)

informationElementUnits 345(informationElementUnits) 345(informationElementUnits)

privateEnterpriseNumber 346(privateEnterpriseNumber) 346(privateEnterpriseNumber)

virtualStationInterfaceId 347(virtualStationInterfaceId) 347(virtualStationInterfaceId)

virtualStationInterfaceName 348(virtualStationInterfaceName) 348(virtualStationInterfaceName)

virtualStationUUID 349(virtualStationUUID) 349(virtualStationUUID)

virtualStationName 350(virtualStationName) 350(virtualStationName)

layer2SegmentId 351(layer2SegmentId) 351(layer2SegmentId)

layer2OctetDeltaCount 352(layer2OctetDeltaCount) 352(layer2OctetDeltaCount)



layer2OctetTotalCount 353(layer2OctetTotalCount) 353(layer2OctetTotalCount)

ingressUnicastPacketTotalCount 354(ingressUnicastPacketTotalCount) 354(ingressUnicastPacketTotalCount)

ingressMulticastPacketTotalCount 355(ingressMulticastPacketTotalCount) 355(ingressMulticastPacketTotalCount)

ingressBroadcastPacketTotalCount 356(ingressBroadcastPacketTotalCount) 356(ingressBroadcastPacketTotalCount)

egressUnicastPacketTotalCount 357(egressUnicastPacketTotalCount) 357(egressUnicastPacketTotalCount)

egressBroadcastPacketTotalCount 358(egressBroadcastPacketTotalCount) 358(egressBroadcastPacketTotalCount)

monitoringIntervalStartMilliSeconds 359(monitoringIntervalStartMilliSeconds)359(monitoringIntervalStartMilliSeconds)

monitoringIntervalEndMilliSeconds 360(monitoringIntervalEndMilliSeconds) 360(monitoringIntervalEndMilliSeconds)

portRangeStart 361(portRangeStart) 361(portRangeStart)

portRangeEnd 362(portRangeEnd) 362(portRangeEnd)

portRangeStepSize 363(portRangeStepSize) 363(portRangeStepSize)

portRangeNumPorts 364(portRangeNumPorts) 364(portRangeNumPorts)

staMacAddress 365(staMacAddress) 365(staMacAddress)

staIPv4Address 366(staIPv4Address) 366(staIPv4Address)

wtpMacAddress 367(wtpMacAddress) 367(wtpMacAddress)

ingressInterfaceType 368(ingressInterfaceType) 368(ingressInterfaceType)

egressInterfaceType 369(egressInterfaceType) 369(egressInterfaceType)

rtpSequenceNumber 370(rtpSequenceNumber) 370(rtpSequenceNumber)

userName 371(userName) 371(userName)

applicationCategoryName 372(applicationCategoryName) 372(applicationCategoryName)

applicationCategoryName 373(applicationCategoryName) 373(applicationCategoryName)

applicationGroupName 374(applicationGroupName) 374(applicationGroupName)

originalFlowsPresent 375(originalFlowsPresent) 375(originalFlowsPresent)

originalFlowsInitiated 376(originalFlowsInitiated) 376(originalFlowsInitiated)

originalFlowsCompleted 377(originalFlowsCompleted) 377(originalFlowsCompleted)

distinctCountOfSourceIPAddress

378(distinctCountOfSourceIPAddress)

378(distinctCountOfSourceIPAddress)

distinctCountOfDestinationIPAddress

379(distinctCountOfDestinationIPAddress)

379(distinctCountOfDestinationIPAddress)

distinctCountOfSourceIPv4Address

380(distinctCountOfSourceIPv4Address)


distinctCountOfDestinationIPv4Address

381(distinctCountOfDestinationIPv4Address)


distinctCountOfSourceIPv6Address



distinctCountOfDestinationIPv6Address



valueDistributionMethod 384(valueDistributionMethod) 384(valueDistributionMethod)

rfc3550JitterMilliseconds 385(rfc3550JitterMilliseconds) 385(rfc3550JitterMilliseconds)

rfc3550JitterMicroseconds 386(rfc3550JitterMicroseconds) 386(rfc3550JitterMicroseconds)

rfc3550JitterNanoseconds 387(rfc3550JitterNanoseconds) 387(rfc3550JitterNanoseconds)

dot1qDEI 388(dot1qDEI) 388(dot1qDEI)



dot1qCustomerDEI 389(dot1qCustomerDEI) 389(dot1qCustomerDEI)

flowSelectorAlgorithm 390(flowSelectorAlgorithm) 390(flowSelectorAlgorithm)

flowSelectedOctetDeltaCount 391(flowSelectedOctetDeltaCount) 391(flowSelectedOctetDeltaCount)

flowSelectedPacketDeltaCount 392(flowSelectedPacketDeltaCount) 392(flowSelectedPacketDeltaCount)

flowSelectedFlowDeltaCount 393(flowSelectedFlowDeltaCount) 393(flowSelectedFlowDeltaCount)

selectorIDTotalFlowsObserved 394(selectorIDTotalFlowsObserved) 394(selectorIDTotalFlowsObserved)

selectorIDTotalFlowsSelected 395(selectorIDTotalFlowsSelected) 395(selectorIDTotalFlowsSelected)

samplingFlowInterval 396(samplingFlowInterval) 396(samplingFlowInterval)

samplingFlowSpacing 397(samplingFlowSpacing) 397(samplingFlowSpacing)

flowSamplingTimeInterval 398(flowSamplingTimeInterval) 398(flowSamplingTimeInterval)

flowSamplingTimeSpacing 399(flowSamplingTimeSpacing) 399(flowSamplingTimeSpacing)

hashFlowDomain 400(hashFlowDomain) 400(hashFlowDomain)

transportOctetDeltaCount 401(transportOctetDeltaCount) 401(transportOctetDeltaCount)

transportPacketDeltaCount 402(transportPacketDeltaCount) 402(transportPacketDeltaCount)

originalExporterIPv4Address 403(originalExporterIPv4Address) 403(originalExporterIPv4Address)

originalExporterIPv6Address 404(originalExporterIPv6Address) 404(originalExporterIPv6Address)

originalObservationDomainId 405(originalObservationDomainId) 405(originalObservationDomainId)

intermediateProcessId 406(intermediateProcessId) 406(intermediateProcessId)

ignoredDataRecordTotalCount 407(ignoredDataRecordTotalCount) 407(ignoredDataRecordTotalCount)

dataLinkFrameType 408(dataLinkFrameType) 408(dataLinkFrameType)

sectionOffset 409(sectionOffset) 409(sectionOffset)

sectionExportedOctets 410(sectionExportedOctets) 410(sectionExportedOctets)

dot1qServiceInstanceTag 411(dot1qServiceInstanceTag) 411(dot1qServiceInstanceTag)

dot1qServiceInstanceId 412(dot1qServiceInstanceId) 412(dot1qServiceInstanceId)

dot1qServiceInstancePriority 413(dot1qServiceInstancePriority) 413(dot1qServiceInstancePriority)

dot1qCustomerSourceMacAddress 414(dot1qCustomerSourceMacAddress) 414(dot1qCustomerSourceMacAddress)

dot1qCustomerDestinationMacAddress

415(dot1qCustomerDestinationMacAddress)

415(dot1qCustomerDestinationMacAddress)

layer2OctetDeltaCount 416(layer2OctetDeltaCount) 416(layer2OctetDeltaCount)

postL2OctetDeltaCount 417(postL2OctetDeltaCount) 417(postL2OctetDeltaCount)

postMCastL2OctetDeltaCount 418(postMCastL2OctetDeltaCount) 418(postMCastL2OctetDeltaCount)

layer2OctetTotalCount 419(layer2OctetTotalCount) 419(layer2OctetTotalCount)

postL2OctetTotalCount 420(postL2OctetTotalCount) 420(postL2OctetTotalCount)

postMCastL2OctetTotalCount 421(postMCastL2OctetTotalCount) 421(postMCastL2OctetTotalCount)

minimumL2TotalLength 422(minimumL2TotalLength) 422(minimumL2TotalLength)

maximumL2TotalLength 423(maximumL2TotalLength) 423(maximumL2TotalLength)

droppedL2OctetDeltaCount 424(droppedL2OctetDeltaCount) 424(droppedL2OctetDeltaCount)

droppedL2OctetTotalCount 425(droppedL2OctetTotalCount) 425(droppedL2OctetTotalCount)

ignoredL2OctetTotalCount 426(ignoredL2OctetTotalCount) 426(ignoredL2OctetTotalCount)

notSentL2OctetTotalCount 427(notSentL2OctetTotalCount) 427(notSentL2OctetTotalCount)

l2OctetDeltaSumOfSquares 428(l2OctetDeltaSumOfSquares) 428(l2OctetDeltaSumOfSquares)



l2OctetTotalSumOfSquares 429(l2OctetTotalSumOfSquares) 429(l2OctetTotalSumOfSquares)

layer2FrameDeltaCount 430(E451layer2FrameDeltaCount) 430(E451layer2FrameDeltaCount)

layer2FrameTotalCount 431(layer2FrameTotalCount) 431(layer2FrameTotalCount)

pseudoWireDestinationIPv4Address 432(pseudoWireDestinationIPv4Address)432(pseudoWireDestinationIPv4Address)

ignoredLayer2FrameTotalCount 433(ignoredLayer2FrameTotalCount) 433(ignoredLayer2FrameTotalCount)

mibObjectValueInteger 434(mibObjectValueInteger) 434(mibObjectValueInteger)

mibObjectValueOctetString 435(mibObjectValueOctetString) 435(mibObjectValueOctetString)

mibObjectValueOID 436(mibObjectValueOID) 436(mibObjectValueOID)

mibObjectValueBits 437(mibObjectValueBits) 437(mibObjectValueBits)

mibObjectValueIPAddress 438(mibObjectValueIPAddress) 438(mibObjectValueIPAddress)

mibObjectValueCounter 439(mibObjectValueCounter) 439(mibObjectValueCounter)

mibObjectValueGauge 440(mibObjectValueGauge) 440(mibObjectValueGauge)

mibObjectValueTimeTicks 441(mibObjectValueTimeTicks) 441(mibObjectValueTimeTicks)

mibObjectValueUnsigned 442(mibObjectValueUnsigned) 442(mibObjectValueUnsigned)

mibObjectValueTable 443(mibObjectValueTable) 443(mibObjectValueTable)

mibObjectValueRow 444(mibObjectValueRow) 444(mibObjectValueRow)

mibObjectIdentifier 445(mibObjectIdentifier) 445(mibObjectIdentifier)

mibSubIdentifier 446(mibSubIdentifier) 446(mibSubIdentifier)

mibIndexIndicator 447(mibIndexIndicator) 447(mibIndexIndicator)

mibCaptureTimeSemantics 448(mibCaptureTimeSemantics) 448(mibCaptureTimeSemantics)

mibContextEngineID 449(mibContextEngineID) 449(mibContextEngineID)

mibContextName 450(mibContextName) 450(mibContextName)

mibObjectName 451(mibObjectName) 451(mibObjectName)

mibObjectDescription 452(mibObjectDescription) 452(mibObjectDescription)

mibObjectSyntax 453(mibObjectSyntax) 453(mibObjectSyntax)

mibModuleName 454(mibModuleName) 454(mibModuleName)

mobileIMSI 455(mobileIMSI) 455(mobileIMSI)

mobileMSISDN 456(mobileMSISDN) 456(mobileMSISDN)

httpStatusCode 457(httpStatusCode) 457(httpStatusCode)

sourceTransportPortsLimit 458(sourceTransportPortsLimit) 458(sourceTransportPortsLimit)

httpRequestMethod 459(httpRequestMethod) 459(httpRequestMethod)

httpRequestHost 460(httpRequestHost) 460(httpRequestHost)

httpRequestTarget 461(httpRequestTarget) 461(httpRequestTarget)

httpMessageVersion 462(natInstanceID) 462(natInstanceID)

natInstanceID 463(natInstanceID) 463(natInstanceID)

internalAddressRealm 464(internalAddressRealm) 464(internalAddressRealm)

externalAddressRealm 465(externalAddressRealm) 465(externalAddressRealm)

natQuotaExceededEvent 466(natQuotaExceededEvent) 466(natQuotaExceededEvent)

natThresholdEvent 467(natThresholdEvent) 467(natThresholdEvent)

httpUserAgent 468(httpUserAgent) 468(httpUserAgent)

httpContentType 769(httpContentType) 769(httpContentType)



httpReasonPhrase 470(httpReasonPhrase) 470(httpReasonPhrase)


IP Flow Information Export (IPFIX) Entities


https://www.iana.org/assignments/ipfix/ipfix.xhtml

Chapter 4. Dashboard reference

Use this reference to understand the Flow or entity metrics that are displayed oneach dashboard, and other properties of the dashboard. The aggregations that areused on the NetFlow dashboards are also specified as applicable.

The following types of metrics are stored in Network Performance Insightdatabase:v Flow metrics

The raw metrics from Flow records are aggregated and stored FLOW_METRICschema tables.

v Entity metricsThe raw metrics that are discovered and polled from Tivoli Network Managerare aggregated and stored in ENTITY_METRIC schema tables.

These individual metrics and a combination of the metrics are displayed in variousdashboards and widgets. The data is queried and retrieved from the database withthe help of REST APIs.

REST (REpresentational State Transfer) APIs rely on a stateless, client/server,cacheable communications protocol. REST applications use HTTP requests to postdata (create and update), read data (such as running queries), and delete data.REST is a lightweight alternative to mechanisms like RPC (Remote ProcedureCalls) and Web Services (such as SOAP and WSDL). Much like Web Services, aREST service is:v Platform-independentv Language-independentv Standards-based (runs on top of HTTP)v Able to be used in the presence of firewalls.

Properties of the Network Performance Overview dashboardThis information provides the properties of the Network Performance Overviewand its associated widgets.

Data flow to Network Performance Overview dashboard and itswidgets

Widget name Metrics Type of data

Top 10 Outbound PacketDiscard Deviation (%)

ifOutDiscards Entity metricNote: Configure this metricfrom Tivoli NetworkManager network polling.

Total Packet Drops PerQueue (Packets)

policyQosQueueDrop Flow metric

Top 10 Inbound PacketDiscard Deviation (%)

ifInDiscards Entity metricNote: Configure this metricfrom Tivoli NetworkManager network polling.


Widget name Metrics Type of data

Top 10 Applications by TotalDelay (ms)

maxTotalRespTime Flow metric (ApplicationResponse Time)

Top 10 Round-Trip TimeDeviation (%)

echoRTT Entity metric (IPSLA)

Top 10 Probe Loss Deviation(%)

echoProbeLoss Entity metric (IPSLA)

Top 10 Outbound UtilizationDeviation (%)

snmpOutBandwidth Entity metricNote: Configure this metricfrom Tivoli NetworkManager network polling.

Top 10 Applications by TotalVolume (Octets)

APP_NAME Flow metric

Top 10 Inbound UtilizationDeviation (%)

snmpInBandwidth Entity metricNote: Configure this metricfrom Tivoli NetworkManager network polling.

Top 10 Applications byAverage Utilization (%)

APP_NAME Flow metric

Top 10 CPULoad Deviation (%)

v CiscoDevice System CPUUtilization CPM

v cpuBusy

v Huawei CPU Utilization

v JuniperChassis CPUUtilization avg last5min

v JuniperERX CPUUtilization

Entity metrics

Top 10Memory Load Deviation (%)

v CiscoDevice Memory PoolUtilization

v Huawei MemoryUtilization

v JuniperERX MemoryUtilization

Entity metrics


Creating simple poll policies

Properties of the NetFlow dashboardsThis information provides the properties of all the NetFlow dashboards.

Data flow to the NetFlow dashboards and widgets

NetFlow dashboards Flow metrics are stored in Network Performance Insightdatabase. The raw metrics from Flow records are aggregated and storedFLOW_METRIC schema tables.

The following table shows the data properties of the Top Talker views in theNetFlow dashboards.


https://www.ibm.com/support/knowledgecenter/SSSHRK_4.2.0/itnm/ip/wip/poll/task/nmip_poll_creatingpollswithsinglepolldefinition.html

Table 3. NetFlow Dashboards

Aggregation name Grouping keys

Top Applications IF_ID + APP_NAME

Top Applications with ToS IF_ID + APP_NAME+SRC_TOS

Top Conversation Autonomous Systems IF_ID+BGP_SRC_AS_NUM+BGP_DST_AS_NUM

Top Destination Autonomous Systems IF_ID+BGP_DST_AS_NUM

Top Source Autonomous Systems IF_ID+BGP_SRC_AS_NUM

Top Conversations IF_ID+SRC_IP+DST_IP

Top Conversations with Applications IF_ID+SRC_IP+DST_IP+APP_NAME

Top Conversations with ToS IF_ID+SRC_IP+DST_IP+SRC_TOS

Top Destinations IF_ID+DST_IP

Top Destinations with Applications IF_ID+DST_IP+APP_NAME

Top Conversation IP Groups withApplications

IF_ID +SRC_IP_GROUP+DST_IP_GROUP+APP_NAME

Top Conversation IP Groups with Protocols IF_ID +SRC_IP_GROUP+DST_IP_GROUP+PROTOCOL_ID

Top Conversation IP Groups with ToS IF_ID +SRC_IP_GROUP+DST_IP_GROUP+SRC_TOS

Top Destination IP Groups with Applications IF_ID+DST_IP_GROUP+APP_NAME

Top Destination IP Groups with Protocols IF_ID+DST_IP_GROUP+PROTOCOL_ID

Top Destination IP Groups with ToS IF_ID+DST_IP_GROUP+SRC_TOS

Top Source IP Groups with Applications IF_ID+SRC_IP_GROUP+APP_NAME

Top Source IP Groups with Protocols IF_ID+SRC_IP_GROUP+PROTOCOL_ID

Top Source IP Groups with ToS IF_ID+SRC_IP_GROUP+SRC_TOS

Top Protocols IF_ID+PROTOCOL_ID

Top Protocols with Applications IF_ID+PROTOCOL_ID+APP_NAME

Top Protocols with Conversations IF_ID+PROTOCOL_ID+SRC_IP+DST_IP

Top Protocols with Destinations IF_ID+PROTOCOL_ID+DST_IP

Top Protocols with Sources IF_ID+PROTOCOL_ID+SRC_IP

Top Sources IF_ID+SRC_IP

Top Sources with Applications IF_ID+SRC_IP+APP_NAME

Top ToS IF_ID+SRC_TOS

QoS Queue Drops IF_ID+POLICY_QOS_CLASSIFICATION_HIERARCHY+POLICY_QOS_QUEUE_ID

Properties of the On Demand Filtering dashboardsThis information provides the properties of all the On Demand Filteringdashboards.

Data flow to On Demand Filtering dashboards

The following table shows the metrics that are displayed on the On DemandFiltering dashboards.

Chapter 4. Dashboard reference 91

Table 4. IPSLA: On Demand Filtering

SLA Test Displayed KPI Associated metrics

v Echo

v TcpConnect

v UdpEcho

Probe Count (count) echoProbeCount

Probe Loss (%) echoProbeLoss

Probe Succeeded (%) echoProbeSucceeded

RTT (ms) echoRtt

Jitter

Inbound Jitter (ms) jitterAvgInbound

Outbound Jitter (ms) jitterAvgOutbound

Inbound One Way Latency(ms)

jitterAvgInboundOneWay

Outbound One Way Latency(ms)

jitterAvgOutboundOneWay

Inbound Packet Loss (%) jitterPacketLossInbound

Outbound Packet Loss (%) jitterPacketLossOutbound

VoIP

Inbound Jitter (ms) jitterAvgInbound

Outbound Jitter (ms) jitterAvgOutbound


jitterAvgInboundOneWay


jitterAvgOutboundOneWay

Inbound Packet Loss (%) jitterPacketLossInbound

Outbound Packet Loss (%) jitterPacketLossOutbound

MOS (count) voipMos

RTP

Inbound Jitter (ms) rtpInterArrivalJitterInbound

Outbound Jitter (ms) rtpInterArrivalJitterOutbound


rtpAvgInbound


rtpAvgOutbound

Inbound Packet Loss (%) rtpPacketLossInbound

Outbound Packet Loss (%) rtpPacketLossOutbound

RTT (ms) rtpRtt

HTTP

RTT (ms) httpRtt

DNS RTT (ms) httpDnsRtt

TCP Connect RTT (ms) httpTcpConnectRtt

Table 5. Device Health: On Demand Filtering

Displayed KPI Associated metrics Type of data

Inbound Utilization (%) snmpInBandwidth Entity metric

Note: Configure thesemetrics from Tivoli NetworkManager network polling.

Outbound Utilization (%) snmpOutBandwidth

Inbound Errors (pkts) ifInErrors

Outbound Errors (pkts) ifOutErrors

Performance Metric OOTB Device Support metrics


Table 5. Device Health: On Demand Filtering (continued)

Displayed KPI Associated metrics Type of data

Inbound Volumes (octets) RFCMIBII Inbound Volume HCoctets

Entity metric

Note: Configure thesemetrics from Tivoli NetworkManager network polling.

Outbound Volumes (octets) RFCMIBII Outbound VolumeHC octets

Inbound Throughput (bps) RFCMIBII InboundThroughput HC bps

Outbound Throughput (bps) RFCMIBII OutboundThroughput HC bps

CPU (%) v cpuBusy

v CiscoDevice System CPUUtilization CPM

v Huawei CPU Utilization

v JuniperChassis CPUService InterruptUtilization

v JuniperChassis CPUUtilization avg last5min

v JuniperERX CPU

Memory (%) v CiscoDevice Memory PoolUtilization

v CiscoDevice SystemMemory Pool Utilization

v Huawei MemoryUtilization

v JuniperChassis BufferUtilization

v JuniperERX MemoryUtilization

Temperature (celsius) v CiscoDevice TemperatureLevel

v Huawei Temperature Level

v JuniperChassisTemperature

For more information, see Supported Cisco IP SLA formulas section in IBM NetworkPerformance Insight: References.

Chapter 4. Dashboard reference 93


Chapter 5. SNMP formulas

Detailed information about the SNMP formulas and their structure in NetworkPerformance Insight.

This information is intended for Network Administrators who must understandthe in-built formulas and their structure. The administrators can modify theformulas or use this information for data validation and interpretation.

See the following sections:

IP SLA formulas

These formulas are used by the Formula Service to create poll definitionrequests for the SNMP Collector Service to start the polling. FormulaService detects new IP SLA Probes or deactivates probes and sets upSNMP Collector for metric collection. Storage Service writes these metricsfrom Kafka topics to the database.

Currently, the Formula Service supports SNMP data from Cisco IPSLAdevices only.

For more information about the Formula Service and SNMP Collector Service,see IBM Network Performance Insight: Product Overview.

Performance Metric OOTB Device Support formulas

The Performance Metric OOTB Device Support provides the performancemetrics with predefined formulas for the following vendor devices andtheir supported MIB files:v Ciscov Juniperv Huawei

For more information about the Performance Metric OOTB Device Support, see IBMNetwork Performance Insight: Product Overview.

Supported Cisco IP SLA formulasUse information to understand the supported metrics that is polled by the IP SLAenabled devices in your network.

The Network Performance Insight Formula Service calculates metric values for thedata that is collected by SNMP Collector. It uses formulas that are deployedagainst specific entity types.

Metrics that are derived from these formulas give insight on the impact of networktraffic load on overall quality of latency sensitive network services. For example,voice call and video streaming quality. Typically, IP SLA handles the followingtypes of metrics:v Delayv Packet Lossv Jitterv Packet Sequence


v Connectivityv Pathv Downtime

Metric names are the same as the names of the formulas that generate them in thepoll definition. The following tables provide metrics that are related to different IPSLA operations in Network Performance Insight:v HTTPv Jitterv VoIPv RTPv UDP Echo

Formulas

Table 6. Entity Type: cisco.probe.http

Metric Formula Units Description

httpDnsRtt rttMonLatestHTTPOperDNSRTT Milliseconds The sum of RTT toperform a Domain NameServer Query (DNS)within the HTTPoperations.

httpRtt rttMonLatestHTTPOperRTT Milliseconds If a successful test iscompleted since the lastpoll, return the sum ofthe round-trip time (RTT)of successful HTTPoperations.

httpTcpConnectRtt rttMonLatestHTTPOperTCPConnectRTT Milliseconds The sum of RTT taken toperform a TCPconnection to the HTTPserver.

httpTransactionRtt rttMonLatestHTTPOperTransactionRTT Milliseconds The sum of Round TripTime (RTT) taken todownload the object thatis specified by URLwithin HTTP operations.

httpTransactionFailed 100 *(not(rttMonLatestHTTPOperSense==""))

Percent The percentage of requestthat has HTTP errorswhen downloading thebase page within HTTPoperations. If no errorsreturn 0, otherwise return100.

httpTransactionSucceeded 100 *((rttMonLatestHTTPOperSense==""))

Percent The percentage of requestthat had no HTTP errorswhen downloading thebase page within HTTPoperations. If no errorsreturn 100, otherwisereturn 0.


Table 7. Entity Type: cisco.probe.jitter


jitterAvgInbound (rttMonLatestJitterOperSumOfPositivesDS+rttMonLatestJitterOperSumOfNegativesDS)/(rttMonLatestJitterOperNumOfRTT - 1)

Milliseconds If a successful probe issent since the last poll,return the averageinbound jitter.

jitterMaxNegativeInbound rttMonLatestJitterOperMaxOfNegativesDS Milliseconds If a successful probe issent since the last poll,return the maximuminbound negative jitter.

jitterPacketLossInbound 100 *rttMonLatestJitterOperPacketLossDS /rttMonEchoAdminNumPackets

Percent If a test is completedsince the last poll, returnthe percentage of inboundpackets lost.

jitterMaxPositiveInbound rttMonLatestJitterOperMaxOfPositivesDS Milliseconds If a successful probe issent since the last poll,return the maximuminbound positive jitter.

jitterSucceeded 100 *rttMonLatestJitterOperNumOfRTT/ rttMonEchoAdminNumPackets

Milliseconds If a successful probe issent since the last poll,return the averageoutbound jitter.

jitterMaxNegativeOutbound rttMonLatestJitterOperMaxOfNegativesSD Milliseconds If a successful probe issent since the last poll,return the maximumoutbound negative jitter.

jitterPacketLossOutbound 100 *rttMonLatestJitterOperPacketLossSD /rttMonEchoAdminNumPackets

Percent If a test is completedsince the last poll, returnthe percentage ofoutbound packets lost.

jitterMaxPositiveOutbound rttMonLatestJitterOperMaxOfPositivesSD Milliseconds If a successful probe issent since the last poll,return the maximumoutbound positive jitter.

jitterPacketCount rttMonEchoAdminNumPackets Number If a test is completedsince the last poll, returnthe number of sentprobes, otherwise return0.

jitterPacketLoss rttMonEchoAdminNumPackets Percent If a test is completedsince the last poll, returnthe number of sentprobes, otherwise return0.

jitterAvgOutbound (rttMonLatestJitterOperRTTSum2 /rttMonLatestJitterOperNumOfRTT -((rttMonLatestJitterOperRTTSum /rttMonLatestJitterOperNumOfRTT) ^ 2))^ 0.5

Milliseconds If a successful probe issent since the last poll,return the standarddeviation of theround-trip time.

jitterPacketLossUnknown 100 *rttMonLatestJitterOperPacketMIA /rttMonEchoAdminNumPackets

Percent If a test is completedsince the last poll, returnthe percentage of packetsthat are lost where thedirection is unknown.

Chapter 5. SNMP formulas 97

Table 7. Entity Type: cisco.probe.jitter (continued)


jitterAvgInboundOneWay rttMonLatestJitterOperOWSumDS /rttMonLatestJitterOperNumOfRTT

Milliseconds The average of the delaysthat travel fromdestination to source forall the probes during thelast test.

jitterAvgOutboundOneWay rttMonLatestJitterOperOWSumSD1 /rttMonLatestJitterOperNumOfRTT

Milliseconds The average of the delaysthat travel from source todestination for all theprobes during the lasttest.

Table 8. Entity Type: cisco.probe.voip


voipIcpif rttMonLatestJitterOperICPIF Number The maximum of allCalculated PlanningImpairment Factor (ICPIF)value for the jitteroperations.

voipMos rttMonLatestJitterOperMOS / 100 Number The maximum of allMean Opinion Score(MOS) value for the jitteroperations.

jitterAvgInbound (rttMonLatestJitterOperSumOfPositivesDS +rttMonLatestJitterOperSumOfNegativesDS) /(rttMonLatestJitterOperNumOfRTT - 1)

Milliseconds If a successful probe issent since the last poll,return the averageinbound jitter.

jitterMaxNegativeInbound rttMonLatestJitterOperMaxOfNegativesDS Milliseconds If a successful probe issent since the last poll,return the maximuminbound negative jitter.

jitterPacketLossInbound 100 *rttMonLatestJitterOperPacketLossSD/ rttMonEchoAdminNumPackets


jitterMaxPositiveInbound rttMonLatestJitterOperMaxOfPositivesDS Milliseconds If a successful probe issent since the last poll,return the maximuminbound positive jitter.

jitterSucceeded 100 *rttMonLatestJitterOperNumOfRTT /rttMonEchoAdminNumPackets

Milliseconds If a successful probe issent since the last poll,return the averageoutbound jitter.

jitterMaxNegativeOutbound rttMonLatestJitterOperMaxOfNegativesSD Milliseconds If a successful probe issent since the last poll,return the maximumoutbound negative jitter.

jitterPacketLossOutbound 100 *rttMonLatestJitterOperPacketLossSD /rttMonEchoAdminNumPackets



Table 8. Entity Type: cisco.probe.voip (continued)


jitterMaxPositiveOutbound rttMonLatestJitterOperMaxOfPositivesSD Milliseconds If a test is completedsince the last poll, returnthe percentage ofoutbound packets lost.

jitterPacketCount rttMonEchoAdminNumPackets Number If a test is completedsince the last poll, returnthe number of sentprobes, otherwise return0.

jitterPacketLoss rttMonEchoAdminNumPackets Percent If a test is completedsince the last poll, returnthe percentage of probeslost.

jitterAvgOutbound (rttMonLatestJitterOperRTTSum2 /rttMonLatestJitterOperNumOfRTT -((rttMonLatestJitterOperRTTSum /rttMonLatestJitterOperNumOfRTT) ^ 2))^ 0.5

Milliseconds If a successful probe issent since the last poll,return the standarddeviation of theround-trip time.

jitterPacketLossUnknown 100 *rttMonLatestJitterOperPacketMIA /rttMonEchoAdminNumPackets


jitterAvgInboundOneWay rttMonLatestJitterOperOWSumDS /rttMonLatestJitterOperNumOfRTT

Milliseconds The average of the delaysthat travel fromdestination to source forall the probes during thelast test.

jitterAvgOutboundOneWay rttMonLatestJitterOperOWSumSD /rttMonLatestJitterOperNumOfRTT

Milliseconds The average of the delaysthat travel from source todestination for all theprobes during the lasttest.

Table 9. Entity Type: cisco.probe.rtp


rtpAvgInbound rttMonLatestRtpOperAvgOWDS Milliseconds If a successful probe issent since the last poll,return the maximuminbound time.

rtpEarlyPacketsInbound 100 *rttMonLatestRtpOperPacketEarlyDS /rttMonLatestRtpOperTotalPaksDS

Percent Number of early packetsat source for the latestoperation.

rtpFrameLossInbound rttMonLatestRtpOperFrameLossDS Percent If a test is completedsince the last poll, returnthe percentage of inboundframe lost.

rtpInterArrivalJitterInbound rttMonLatestRtpOperIAJitterDS Milliseconds If a successful probe issent since the last poll,return the maximuminbound jitter.


Table 9. Entity Type: cisco.probe.rtp (continued)


rtpLatePacketsInbound 100 *rttMonLatestRtpOperPacketLateDS /rttMonLatestRtpOperTotalPaksDS

Percent Number of late packets atsource for the latestoperation.

rtpMosCqInbound rttMonLatestRtpOperMOSCQDS Number The average estimatedinbound Mean OpinionScore for ConversationalQuality (MOS-CQ).

rtpMosLqInbound rttMonLatestRtpOperMOSLQDS Number The average estimatedinbound Mean OpinionScore for ListeningQuality (MOS-LQ).

rtpPacketLossInbound 100 *rttMonLatestRtpOperPacketLossDS /rttMonLatestRtpOperTotalPaksDS


rtpRFactorInbound rttMonLatestRtpOperRFactorDS Number The average of estimatedvoice quality value that istransmitted fromdestination to source forthe RTP operation.

rtpAvgOutbound rttMonLatestRtpOperAvgOWSD Milliseconds If a successful probe issent since the last poll,return the maximumoutbound time.

rtpInterArrivalJitterOutboundrttMonLatestRtpOperIAJitterSD.%I1 * Milliseconds If a successful probe issent since the last poll,return the maximumoutbound jitter.

rtpMosCqOutbound rttMonLatestRtpOperMOSCQSD Number The average estimatedoutbound Mean OpinionScore for ConversationalQuality (MOS-CQ).

rtpPacketLossOutbound 100 *rttMonLatestRtpOperPacketLossSD /rttMonLatestRtpOperTotalPaksSD


rtpRFactorOutbound rttMonLatestRtpOperRFactorSD Number The average of estimatedvoice quality value that istransmitted from sourceto destination for the RTPoperation.

rtpRtt rttMonLatestRtpOperRTT Milliseconds If a successful test iscompleted since the lastpoll, return the round-triptime.

rtpPacketLossUnknown 100 *rttMonLatestRtpOperPacketsMIA /rttMonLatestRtpOperTotalPaksSD



Table 10. Entity Type: cisco.probe.echo


echoProbeCount not(rttMonLatestRttOperTime ==last(rttMonLatestRttOperTime))

Number If a test is completed sincethe last poll, return 1,otherwise return 0.

echoProbeLoss 100 *not(rttMonLatestRttOperSense == 1)

Percent If a test is completed sincethe last poll, return thepercentage of probes lost.

echoProbeSucceeded 100 * (rttMonLatestRttOperSense == 1) Percent If a test is completed sincethe last poll, return thepercentage of probes thatsucceeded.

echoRtt rttMonLatestRttOperCompletionTime Milliseconds If a successful test iscompleted since the lastpoll, return the round-triptime.

Note: The echo operation covers the following SLA test types:v echo

v tcpConnect

v udpEcho

Supported Performance Metric OOTB Device Support discovery agents

The object identifiers (OID) explains how SNMP values are retrieved from adevice, and stored. The discovery agents use the formula service to calculate metricvalues for the data that is collected by SNMP Collector.

The following columns in the tables provide the reference information on thereports for the selected vendor type.v Discovery Agent Name

The discovery agent name for the specific vendor.v Entity Name

Specifies the entity name of the discovery agent.v Poll Definition

Specifies the metric name. Metric names are the same as the names of theformulas that generate them, the poll definition.

v Discovery FormulaSpecifies the discovery formula that is used for the metric calculation of anentity.

Table 11. Discovery Agent

DiscoveryAgent Name Entity Name Poll Definition Discovery Formula

PODS_Cisco_Processor

Processor Name

<IP>_ProcessorName:<cpmCPUTotalIndex>

CiscoDeviceSystem CPUUtilization CPM

if found(OID(cpmCPUTotal5min)or OID(cpmCPUTotal5minRev))


Table 11. Discovery Agent (continued)


PODS_Cisco_Envmon

Power Supply

<IP>_PowerSupply:<ciscoEnvMonSupplyStatusIndex>

CiscoDevicePower Supply State

OID(ciscoEnvMonSupplyState !=5)

Voltage Test Point

<IP>_VoltageTestPoint:<ciscoEnvMonVoltageStatusIndex>

CiscoDeviceVoltage Level

OID(ciscoEnvMonVoltageStatusDescr)

Fan Unit

<IP>_FanUnit:<ciscoEnvMonFanStatusIndex>

CiscoDeviceFan State

OID(ciscoEnvMonFanStatusDescr)

Temperature Test Point

<IP>_TemperatureTestPoint:<ciscoEnvMonTemperatureStatusIndex>

CiscoDeviceTemperature Level

OID(ciscoEnvMonTemperatureState != 5)

PODS_Cisco_Memory_Pool

Memory Pool

<IP>_MemoryPool:<ciscoMemoryPoolType>

v CiscoDeviceSystem Memory PoolLargest Free

v CiscoDeviceSystem Memory PoolFree

v CiscoDeviceSystem Memory PoolUtilization

OID(ciscoMemoryPoolValid == 1)

PODS_Cisco_Entity_Sensor

ASR Nexus Environment

<IP>_ASR_Nexus_Environment:<entPhysicalIndex>

v CiscoDeviceNexus Current Level

v CiscoDeviceASR Nexus Fan State

(if OID(entSensorType==5)and found OID(entSensorStatus))OR(OID(entPhysicalClass == 7) andfound OID(cefcFanTrayOperStatus))




PODS_Cisco_Enhanced_Mempool

Enhanced Memory Pool

<IP>_Enhanced_Memory_Pool:<ciscoMemoryPoolType><cempMemPoolIndex>

v CiscoDeviceMemory Pool In Use

v CiscoDeviceMemory PoolUnsuccessfulDeAllocations

v CiscoDeviceMemory PoolSuccessfulDeAllocations

v CiscoDeviceMemory PoolLargest Free Block

v CiscoDeviceMemory Pool Free

v CiscoDeviceMemory PoolUnsuccessfulAllocations

v CiscoDeviceMemory PoolSuccessfulAllocations

v CiscoDeviceMemory PoolUtilization

OID(cempMemPoolType)




PODS_Huawei_Entity

Huawei Modules

<IP>_Huawei_Modules:<entPhysicalIndex>

v HuaweiCPU Utilization

v HuaweiMemory Utilization

v HuaweiModule State

v HuaweiPower Supply State

v HuaweiTemperature Level

v HuaweiVoltage Level

(OID(entPhysicalClass == 9) ANDOID(entPhysicalDescr like "*Board")AND found OID(hwEntityCpuUsageThreshold))

OR

(OID((entPhysicalClass == 9) OROID(entPhysicalClass== 7))ANDOID((entPhysicalDescr like "FAN*")OR (entPhysicalDescr like "Fan*"))AND found OID(entPhysicalDescr)AND found OID(entPhysicalName))

OR

(OID(entPhysicalClass == 9) ANDOID(entPhysicalDescr like "*Board")AND(found OID(hwEntityMemSize)ORfound OID(hwEntityMemUsageThreshold)))

OR

(OID((entPhysicalClass == 9) OROID(entPhysicalClass. == 6))ANDOID((entPhysicalDescr like "POWER*")OROID(entPhysicalDescr like "Power*"))

AND found OID(entPhysicalDescr)AND found OID(entPhysicalName))

OR

(OID(entPhysicalClass == 9) ANDOID(entPhysicalDescr like "*Board")AND(foundOID(hwEntityTemperatureThreshold)ORfoundOID(hwEntityTemperatureLowThreshold)))

OR

(OID(entPhysicalClass == 9) ANDOID(entPhysicalDescr like "*Board")AND(foundOID(hwEntityVoltageLowThreshold)ORfoundOID(hwEntityVoltageHighThreshold)))




PODS_Juniper_System

Juniper ERX Module

<IP>_JuniperERXModule:<juniSystemSlotNumber><juniSystemSlotLevel>

v JuniperERXCPU Utilization

v JuniperERXMemory Utilization

OID(juniSystemSlotStatus == 4) AND((OID(juniSystemSlotType == 1) OROID(juniSystemSlotType == 2) OROID(juniSystemSlotType == 16) OROID(juniSystemSlotType == 17) OROID(juniSystemSlotType == 18)) ANDfoundOID(juniSystemModuleCurrentType)

PODS_Juniper_Chassis

Chassis or FPC or PIC

<IP>_Chassis/FPC/PIC:<jnxOperatingContentsIndex><jnxOperatingL1Index><jnxOperatingL2Index><jnxOperatingL3Index>

v JuniperChassisBuffer Utilization

v JuniperChassisCPU ServiceInterrupt Utilization

v JuniperChassisCPU Utilizationavg last 5min

v JuniperChassisHeap Utilization

v JuniperChassisTemperature

if ( OID(jnxOperatingDescr) like("*temp sensor*" or "SSB*" or "SCB*"or "SFM*"or "FEB*" or "FPC*" or"PIC* or "midplane")thenskipnext

if( OID(jnxContainersLevel.<jnxOperatingContentsIndex>) ) = 0containerlevel ="Chassis"m_EntPhysName =OID(jnxFilledDescr)m_EntPhysicalDescr =OID(jnxFilledDescr)end

if( OID(jnxContainersLevel) ) = 1containerlevel = "FPC"m_EntPhysName =OID(jnxFilledDescr)m_EntPhysicalDescr =OID(jnxFilledDescr)

end

if( OID(jnxContainersLevel) ) = 2containerlevel = "PIC"m_EntPhysName =OID(jnxFilledDescr)m_EntPhysicalDescr =OID(jnxFilledDescr)end

Supported Performance Metric OOTB Device Support formulas

The pre-loaded device performance metrics that are polled from the supportedvendor devices.

The formula service calculates metric values for the data that is collected by SNMPCollector. It uses formulas that are deployed against specific entity types.


Reports contain metrics that are generated by the formulas according to thevendor-specific ready-to-use performance packs:v SNMP RFC MIB II Devicev Juniper Devicev Cisco Devicev Huawei SNMP Device

The following columns in the tables provide the reference information on thereports for the selected vendor type.v Poll Definition

Specifies the metric name. Metric names are the same as the names of theformulas that generate them, the poll definition.

v UnitSpecifies in which unit the value is populated in the report.

v FormulaSpecifies the formula that is used for the metric calculation.

v DescriptionProvides a brief description on the formula calculation. For metrics that arelisted in a particular report, the description of the associated formula can be seenfrom the description column in the table.

RFC MIB-IIThis topic provides information on the supported metrics that are polled by SNMPRFC MIB-II.

Reports contain metrics that are generated by the formulas. The table lists thedetails for the following supported entity types for RFC MIB-II:1. Entity Type: Chassis2. Entity Type: Interface

Table 12. Entity Type: Chassis

Poll Definition Unit Formula Description

RFCMIBIIFragmentation Failures

Number 100*(eval(int,"&SNMP.DELTA.ipFragFails")/eval(int,"&SNMP.DELTA.sysUpTime"))

(PODS) The number of IPdatagrams that is discardedbecause they needed to befragmented at this entity butmight not be.

Note: PODS is an abbreviationfor Performance Metric OOTBDevice Support

RFCMIBIIICMP Messages Receivedper second

Number 100*(eval(int,"&SNMP.DELTA.icmpInMsgs")/eval(int,"&SNMP.DELTA.sysUpTime"))

(PODS) The total number ofICMP messages received bythis entity.

RFCMIBIIICMP Messages Sentper second

Number 100*(eval(int,"&SNMP.DELTA.icmpOutMsgs")/eval(int,"&SNMP.DELTA.sysUpTime"))

(PODS) The total number ofICMP messages, which theentity attempted to send.


Table 12. Entity Type: Chassis (continued)


RFCMIBIIIP Out Requestper second

Number 100*(eval(int,"&SNMP.DELTA.ipOutRequests")/eval(int,"&SNMP.DELTA.sysUpTime"))

(PODS) The total number of IPdatagrams are supplied to IPfor transmission by the localIP user-protocols (includingICMP).

RFCMIBIIIP Packets Forwardedper second

Number 100*(eval(int,"&SNMP.DELTA.ipForwDatagrams")/eval(int,"&SNMP.DELTA.sysUpTime"))

(PODS) The number of inputdatagrams for this entity wasnot their final IP destination.

RFCMIBIIIP Packets Receivedper second

Number 100*(eval(int,"&SNMP.DELTA.ipInReceives")/eval(int,"&SNMP.DELTA.sysUpTime"))

(PODS) The total number ofinput datagrams are receivedfrom interfaces, includingthose input datagrams in error.

RFCMIBIINo Routeper second

Number 100*(eval(int,"&SNMP.DELTA.ipOutNoRoutes")/eval(int,"&SNMP.DELTA.sysUpTime"))

(PODS) The number of IPdatagrams that are discardedbecause no route might befound to transmit them totheir destination.

RFCMIBIIPing Replies Receivedper second

Number 100*(eval(int,"&SNMP.DELTA.icmpInEchoReps")/eval(int,"&SNMP.DELTA.sysUpTime"))

(PODS) The total number ofICMP echoes reply messages.

RFCMIBIIPing Replies Sentper second

Number 100*(eval(int,"&SNMP.DELTA.icmpOutEchoReps")/eval(int,"&SNMP.DELTA.sysUpTime"))

(PODS) The total number ofICMP echoes reply messagesthat are sent.

RFCMIBIIPing Sentper second

Number 100*(eval(int,"&SNMP.DELTA.icmpOutEchos")/eval(int,"&SNMP.DELTA.sysUpTime"))

(PODS) The total number ofICMP echo requests (ping).

RFCMIBIIPings Receivedper second

Number 100*(eval(int,"&SNMP.DELTA.icmpInEchos")/eval(int,"&SNMP.DELTA.sysUpTime"))

(PODS) The total number ofICMP echo request (ping)messages received.

RFCMIBIIReassembly Failuresper second

Number 100*(eval(int,"&SNMP.DELTA.ipReasmFails")/eval(int,"&SNMP.DELTA.sysUpTime"))

(PODS) The number of failuresthat are detected by the IPreassembly algorithm (such astime out, errors and etc).

Table 13. Entity Type: Interface


RFCMIBIIDelivered UMB HC

Packets eval(int,"&SNMP.DELTA.ifHCInUcastPkts")+ eval(int,"&SNMP.DELTA.ifHCInMulticastPkts")+ eval(int,"&SNMP.DELTA.ifHCInBroadcastPkts")

(PODS) The total number ofpackets that are delivered to ahigher layer, during the lastpolling period. This metricexcludes any packets that werereceived by an interface, butwere not passed on.


Table 13. Entity Type: Interface (continued)


RFCMIBIIDelivered UMB LC

Packets eval(int,"&SNMP.DELTA.ifInUcastPkts")+ eval(int,"&SNMP.DELTA.ifInMulticastPkts")+ eval(int,"&SNMP.DELTA.ifInBroadcastPkts")


RFCMIBIIDelivered UNU

Packets eval(int,"&SNMP.DELTA.ifInUcastPkts")+ eval(int,"&SNMP.DELTA.ifInNUcastPkts")


RFCMIBIIInbound BroadcastHC pps

Packetspersecond

eval(long64,"&SNMP.DELTA.ifHCInBroadcastPkts")/ eval(long64,"&POLL.POLLINTERVAL")

(PODS) The rate, per second,at which the inboundbroadcast packets at this layerwere delivered to a higherlayer, during the last pollingperiod.

RFCMIBIIInbound BroadcastLC pps

Packetspersecond

eval(long64,"&SNMP.DELTA.ifInBroadcastPkts")/ eval(long64,"&POLL.POLLINTERVAL")

(PODS) The rate, per second,at which the inboundbroadcast packets at this layerwere delivered to a higherlayer, during the last pollingperiod.

RFCMIBIIInbound MulticastHC pps

Packetspersecond

eval(long64,"&SNMP.DELTA.ifHCInMulticastPkts")/eval(long64,"&POLL.POLLINTERVAL")

(PODS) The rate, per second,at which the inboundmulticast packets at this layerwere delivered to a higherlayer, during the last pollingperiod.

RFCMIBIIInbound MulticastLC pps

Packetspersecond

eval(long64,"&SNMP.DELTA.ifInMulticastPkts ")/ eval(long64,"&POLL.POLLINTERVAL")

(PODS) The rate, per second,at which the inboundmulticast packets at this layerwere delivered to a higherlayer, during the last pollingperiod.

RFCMIBIIInbound NonUnicastpps

Packetspersecond

eval(long64,"&SNMP.DELTA.ifInNUcastPkts")/ eval(long64,"&POLL.POLLINTERVAL")

(PODS) The rate, per second,at which non-unicast packetsat this layer were delivered toa higher layer during the lastpolling period.

This formula usesifInNUcastPkts, which has noHC equivalent so there are noLC/HC variants of theformula.Note: The InboundNon-Unicast (pps) formulamaps to the same Genericformula as the SNMPMulticast collection formulas.




RFCMIBIIInbound ThroughputHC bps

Bits persecond

8*eval(long64,"&SNMP.DELTA.ifHCInOctets")/ eval(long64,"&POLL.POLLINTERVAL")

(PODS) The average rate, inbits-per-second, of inboundtraffic on this resource duringthe last polling period.

RFCMIBIIInbound ThroughputLC bps

Bits persecond

8*eval(long64,"&SNMP.DELTA.ifInOctets")/eval(long64,"&POLL.POLLINTERVAL")

(PODS) The average rate, inbits-per-second, of inboundtraffic on this resource duringthe last polling period.

RFCMIBIIInbound UnicastHC pps

Packetspersecond

eval(long64,"&SNMP.DELTA.ifHCInUcastPkts")/eval(long64,"&POLL.POLLINTERVAL")

(PODS) The rate, per second,at which inbound packetswere received, and deliveredto a higher layer during thelast polling period. Thecalculation does not includepackets that are addressed to amulticast or broadcast addressat this layer.

RFCMIBIIInbound UnicastLC pps

Packetspersecond

eval(long64,"&SNMP.DELTA.ifInUcastPkts")/eval(long64,"&POLL.POLLINTERVAL")

(PODS) The rate, per second,at which inbound packetswere received, and deliveredto a higher layer during thelast polling period. Thecalculation does not includepackets that are addressed to amulticast or broadcast addressat this layer.

RFCMIBIIInbound UtilizationHC percent

Percentage 100*(((8*eval(long64,"&SNMP.DELTA.ifHCInOctets"))/eval(long64,"&POLL.POLLINTERVAL"))/ eval(long64,"&SNMP.VALUE.ifSpeed"))

(PODS) The averagepercentage of the inboundbandwidth (capacity) used onthis interface during the lastpolling period. The percentageis valid only if the interfacehas a defined bandwidth (thatis, ifSpeed is nonzero).

RFCMIBIIInbound UtilizationHCHS percent

Percentage (((8*eval(long64,"&SNMP.DELTA.ifHCInOctets"))/eval(long64,"&POLL.POLLINTERVAL"))/eval(long64,"&SNMP.VALUE.ifHighSpeed"))/10000

(PODS) The averagepercentage of the inboundbandwidth (capacity) used onthis interface during the lastpolling period. The percentageis valid only if the interfacehas a defined bandwidth (thatis, ifSpeed is nonzero).

RFCMIBIIInbound VolumeHC octets

Octets eval(int,"&SNMP.DELTA.ifHCInOctets")

(PODS) The number of octets(bytes) received on thisinterface since the lastsuccessful retrieval of thisvalue.

RFCMIBIIInbound VolumeLC octets

Octets eval(int,"&SNMP.DELTA.ifInOctets")

(PODS) The number of octets(bytes) received on thisinterface since the lastsuccessful retrieval of thisvalue.




RFCMIBIIOutbound BroadcastHC pps

Packetspersecond

eval(long64,"&SNMP.DELTA.ifHCOutBroadcastPkts")/ eval(long64,"&POLL.POLLINTERVAL")

(PODS) The rate, per second,at which the outboundbroadcast packets at this layerwere delivered to a higherlayer, during the last pollingperiod. The delivered packetsinclude those packets thatwere dropped and nottransmitted.

RFCMIBIIOutbound BroadcastLC pps

Packetspersecond

eval(long64,"&SNMP.DELTA.ifOutBroadcastPkts")/eval(long64,"&POLL.POLLINTERVAL")

(PODS) The rate, per second,at which the outboundbroadcast packets at this layerwere delivered to a higherlayer, during the last pollingperiod. The delivered packetsinclude those packets thatwere dropped and nottransmitted.

RFCMIBIIOutbound MulticastHC pps

Packetspersecond

eval(long64,"&SNMP.DELTA.ifHCOutMulticastPkts")/ eval(long64,"&POLL.POLLINTERVAL")

(PODS) The rate, per second,at which the outboundmulticast packets weredelivered to this interface,during the last polling period.These packets include packetsthat were dropped and nottransmitted.

RFCMIBIIOutbound MulticastLC pps

Packetspersecond

eval(long64,"&SNMP.DELTA.ifOutMulticastPkts")/eval(long64,"&POLL.POLLINTERVAL")

(PODS) The rate, per second,at which the outboundmulticast packets weredelivered to this interface,during the last polling period.These packets include packetsthat were dropped and nottransmitted.

RFCMIBIIOutbound NonUnicastpps

Packetspersecond

eval(long64,"&SNMP.DELTA.ifOutNUcastPkts")/eval(long64,"&POLL.POLLINTERVAL")

(PODS) The rate, per second,at which non-unicast packetsat this layer were delivered tothis interface during the lastpolling period.

This formula usesifOutNUcastPkts, which hasno HC equivalent so there areno LC/HC variants of theformula.

Note: The OutboundNon-Unicast (pps) formulamaps to the same Genericformula as the SNMPMulticast collection formulas.

RFCMIBIIOutbound ThroughputHC bps

Bits persecond

8*eval(long64,"&SNMP.DELTA.ifHCOutOctets")/eval(long64,"&POLL.POLLINTERVAL")

(PODS) The average rate, inbits-per-second, of outboundtraffic on this resource duringthe last polling period.




RFCMIBIIOutbound ThroughputLC bps

Bits persecond

8*eval(long64,"&SNMP.DELTA.ifOutOctets")/eval(long64,"&POLL.POLLINTERVAL")

(PODS) The average rate, inbits-per-second, of outboundtraffic on this resource duringthe last polling period.

RFCMIBIIOutbound UnicastHC pps

Packetspersecond

eval(long64,"&SNMP.DELTA.ifHCOutUcastPkts")/eval(long64,"&POLL.POLLINTERVAL")

(PODS) The rate, per second,at which outbound packetswere presented to thisinterface during the lastpolling period. The calculationdoes not include packetsaddressed to a multicast orbroadcast address at this layer,but does include droppedpackets that were nottransmitted.

RFCMIBIIOutbound UnicastLC pps

Packetspersecond

eval(long64,"&SNMP.DELTA.ifOutUcastPkts")/eval(long64,"&POLL.POLLINTERVAL")

(PODS) The rate, per second,at which outbound packetswere presented to thisinterface during the lastpolling period. The calculationdoes not include packets thatare addressed to a multicast orbroadcast address at this layer,but does include droppedpackets that were nottransmitted.

RFCMIBIIOutbound UtilizationHC percent

Percentage 100*(((8*eval(long64,"&SNMP.DELTA.ifHCOutOctets"))/eval(long64,"&POLL.POLLINTERVAL"))/ eval(long64,"&SNMP.VALUE.ifSpeed"))

(PODS) The averagepercentage of the outboundbandwidth (capacity) used onthis resource on this interfaceduring the last polling period.This percentage is valid only ifthe interface has a definedbandwidth, that is, the ifSpeedOID (defined in theRFC1213-MIB) is nonzero.

RFCMIBIIOutbound UtilizationHCHS percent

Percentage (((8*eval(long64,"&SNMP.DELTA.ifHCOutOctets"))/eval(long64,"&POLL.POLLINTERVAL"))/eval(long64,"&SNMP.VALUE.ifHighSpeed"))/10000

(PODS) The averagepercentage of the outboundbandwidth (capacity) used onthis resource on this interfaceduring the last polling period.This percentage is valid only ifthe interface has a definedbandwidth, that is, the ifSpeedOID (defined in theRFC1213-MIB) is nonzero.

RFCMIBIIOutbound VolumeHC octets

Octets eval(int,"&SNMP.DELTA.ifHCOutOctets")

(PODS) The number of octets(bytes) transmitted out of thisinterface during the lastpolling period.

RFCMIBIIOutbound VolumeLC octets

Octets eval(int,"&SNMP.DELTA.ifOutOctets")

(PODS) The number of octets(bytes) transmitted out of thisinterface during the lastpolling period.




RFCMIBIITransmitted UMBDE HC

Number eval(int,"&SNMP.DELTA.ifHCOutUcastPkts")+ eval(int,"&SNMP.DELTA.ifHCOutMulticastPkts")+ eval(int,"&SNMP.DELTA.ifHCOutBroadcastPkts")- eval(int,"&SNMP.DELTA.ifOutDiscards")- eval(int,"&SNMP.DELTA.ifOutErrors")

(PODS) The total packets (allpackets) transmitted out ofthis interface during the lastpolling period.

RFCMIBIITransmitted UMBDE LC

Number eval(int,"&SNMP.DELTA.ifOutUcastPkts")+ eval(int,"&SNMP.DELTA.ifOutMulticastPkts")+ eval(int,"&SNMP.DELTA.ifOutBroadcastPkts")- eval(int,"&SNMP.DELTA.ifOutDiscards")- eval(int,"&SNMP.DELTA.ifOutErrors")


RFCMIBIITransmitted UNUDE

Number eval(int,"&SNMP.DELTA.ifOutUcastPkts")+ eval(int,"&SNMP.DELTA.ifOutNUcastPkts")- eval(int,"&SNMP.DELTA.ifOutDiscards")- eval(int,"&SNMP.DELTA.ifOutErrors")


RFCMIBIIUnknown Protocols

Number eval(int,"&SNMP.DELTA.ifInUnknownProtos")

(PODS) The number of packetsor transmission units droppedbecause of an unknown orunsupported protocol. Thevalue is returned as zero byany interface, which has noconcept of protocol.

CiscoThis topic provides information on the supported metrics that are polled by Ciscodevice.

Reports contain metrics that are generated by the formulas. The table lists thedetails for Cisco device poller.

Table 14. Cisco Device Poller


CiscoDeviceSystem CPUUtilization CPM

Percentage cpmCPUTotal5minRev (PODS) The overall CPU busypercentage over the last 5-minuteperiod.

Note: PODS is an abbreviationfor Performance Metric OOTBDevice Support


Table 14. Cisco Device Poller (continued)


CiscoDevicePower Supply State

Number ciscoEnvMonSupplyState (PODS) The raw value ofciscoEnvMonSupplyState, whichis an enumerated integer.

State values are as follows:

v normal (1)

v warning (2)

v critical (3)

v shutdown (4)

v notPresent (5)

v notFunctioning (6)

CiscoDeviceVoltage Level

Voltage eval(long64,"&SNMP.VALUE.ciscoEnvMonVoltageStatusValue")/1000

(PODS) Calculates the raw value,in volts, of the Voltage statusvalue from theCISCOENVMON-MIB.

The syntax format clean isrequired to ensure that negativevalues are presented correctly.

CiscoDeviceFan State

Number ciscoEnvMonFanState (PODS) Calculates the raw valueof ciscoEnvMonFanState, which isan enumerated integer.


v normal (1)

v warning (2)

v critical (3)

v shutdown (4)

v notPresent (5)

v notFunctioning (6)

CiscoDeviceTemperature Level

Celsius ciscoEnvMonTemperatureStatusValue

(PODS) Calculates the raw value,in degrees Celsius, oftemperaturestatus value.

CiscoDeviceSystem MemoryPool Largest Free

Bytes ciscoMemoryPoolLargestFree (PODS) The largest number ofcontiguous bytes from thememory pool that are currentlyunused on the managed device.

CiscoDeviceSystem Memory Pool Free

Bytes ciscoMemoryPoolFree (PODS) Indicates the number ofbytes from the memory pool thatare currently unused on themanaged device. This formulacalculates the number of bytesfrom the memory pool that arecurrently unused on themanaged device.

CiscoDeviceSystem MemoryPool Utilization

Percentage 100*eval(int,"&SNMP.VALUE.ciscoMemoryPoolUsed")/(eval(int,” ,"&SNMP.VALUE.ciscoMemoryPoolUsed")+(eval(int,” ,"&SNMP.VALUE.ciscoMemoryPoolFree"))

(PODS) The percentage of amemory pool that is used on themanaged device.




CiscoDeviceNexus Current Level

Number cefcFRUCurrent (PODS) Current supplied by theFRU (positive values) or currentrequired to operate the FRU(negative values).

CiscoDeviceASR Nexus Fan State

Number cefcFanTrayOperStatus (PODS) The operational state ofthe fan.


v unknown (1)

v up(powered on) (2)

v down (powered down) (3)

v warning (partial failure, needsreplacement as soon aspossible) (4)

CiscoDeviceMemory Pool In Use

Bytes cempMemPoolUsed (PODS) Indicates the number ofbytes from the memory pool thatare currently in use byapplications on the physicalentity.

CiscoDeviceMemory PoolUnsuccessfulDeAllocations

Number cempMemPoolFreeMiss (PODS) Indicates the number ofunsuccessful attempts tofree/deallocate memory from thememory pool.

CiscoDeviceMemory PoolSuccessful DeAllocations

Number cempMemPoolFreeHit (PODS) Indicates the number ofsuccessful frees or deallocationfrom the memory pool.

CiscoDeviceMemory PoolLargest Free Block

Bytes cempMemPoolLargestFree (PODS) Indicates the largestnumber of contiguous bytes fromthe memory pool that arecurrently unused on the physicalentity.

CiscoDeviceMemory Pool Free

Number cempMemPoolFree (PODS) Indicates the number ofbytes from the memory pool thatare currently unused on thephysical entity.

CiscoDeviceMemory PoolUnsuccessful Allocations

Number cempMemPoolAllocMiss (PODS) Indicates the number ofunsuccessful allocations from thememory pool.

CiscoDeviceMemory PoolSuccessful Allocations

Number cempMemPoolAllocHit (PODS) Indicates the number ofsuccessful allocations from thememory pool.

CiscoDeviceMemory Pool Utilization

Percentage 100*eval(int,"&SNMP.VALUE.cempMemPoolUsed")/(eval(int,"&SNMP.VALUE.cempMemPoolUsed")+ eval(int,"&SNMP.VALUE.cempMemPoolFree"))

(PODS) Indicates the percentageof the enhanced memory poolthat is used on the manageddevice.




CiscoDeviceSystem BufferUtilization IOS10

Percentage 100 * ((eval(int,"&SNMP.VALUE.bufferSmTotal")+ eval(int,"&SNMP.VALUE.bufferMdTotal")+ eval(int,"&SNMP.VALUE.bufferBgTotal")+ eval(int,"&SNMP.VALUE.bufferLgTotal")+ eval(int,"&SNMP.VALUE.bufferHgTotal"))- (eval(int,"&SNMP.VALUE.bufferSmFree")+ eval(int,"&SNMP.VALUE.bufferMdFree")+ eval(int,"&SNMP.VALUE.bufferBgFree")+ eval(int,"&SNMP.VALUE.bufferLgFree")+ eval(int,"&SNMP.VALUE.bufferHgFree")))/ (eval(int,"&SNMP.VALUE.bufferSmTotal")+ eval(int,"&SNMP.VALUE.bufferMdTotal")+ eval(int,"&SNMP.VALUE.bufferBgTotal")+ eval(int,"&SNMP.VALUE.bufferLgTotal")+ eval(int,"&SNMP.VALUE.bufferHgTotal"))

(PODS) The percentage ofmemory buffers that are utilized,based on the number of buffersnot the amount of memory.

CiscoDeviceInbound Runts

Number locIfInRunts (PODS) The number of packetsinput, which is smaller than theallowable physical mediapermitted.

CiscoDeviceInbound Abort

Number locIfInAbort (PODS) Valid on packet-orientedinterfaces only. The number oferror-free packets droppedduring the last polling period.Packets might be dropped forcapacity reasons (no buffer space)or for traffic-shaping reasons.

CiscoDeviceInbound Frame

Number locIfInFrame (PODS) Number of inputpackets, which were misaligned.

CiscoDeviceInbound CRC

Number locIfInCRC (PODS) Number of inputpackets, which had cyclicredundancy checksum errors.

CiscoDeviceInbound Giants

Number locIfInGiants (PODS) Number of inputpackets, which were larger thanthe physical media permitted.

CiscoDeviceInbound Ignored

Number locIfInIgnored (PODS) Number of inputpackets, which were ignored bythis interface.

CiscoDeviceInbound OverRun

Number locIfInOverrun (PODS) Count of input, whicharrived too quickly for thehardware to receive.


JuniperThis topic provides information on the supported metrics that are polled byJuniper device.

Reports contain metrics that are generated by the formulas. The table lists thedetails for Juniper device poller.

Table 15. Juniper Device Poller


JuniperERXCPU Utilization

Percentage juniSystemModuleCpuUtilPct (PODS) The percentageof CPU utilization.

Note: PODS is anabbreviation forPerformance MetricOOTB Device Support

JuniperERXMemory Utilization

Percentage juniSystemModuleMemUtilPct (PODS) The percentageof total memory in useout of all memory that isallocated for the device.

JuniperChassisBuffer Utilization

Percentage jnxOperatingBuffer (PODS) The percentageof memory buffers in useat polling time.

JuniperChassisCPU Service InterruptUtilization

Percentage jnxOperatingISR (PODS) The percentageof CPU cycles that isused in interrupt serviceroutine (ISR) processing.

The value is returned aszero is its unavailable ofnon applicable.

JuniperChassisCPU Utilization avglast 5min

Percentage jnxOperatingCPU (PODS) The averagepercentage of CPUutilization that isexperienced during thelast full 5-minute,vendor-scheduled timesegment before polling.

The average busypercentage is calculatedinternally by the deviceand the sample period isfixed.

JuniperChassisHeap Utilization

Percentage jnxOperatingHeap (PODS) The percentageheap utilization of theentry.

JuniperChassisTemperature

Celsius jnxOperatingTemp (PODS) Collects thereported temperature ofthe entry, in degreesCelsius.


HuaweiThis topic provides information on the supported metrics that are polled byHuawei device.

Reports contain metrics that are generated by the formulas. The table lists thedetails for Huawei device poller.

Table 16. Huawei Device Poller


HuaweiCPU Utilization

Percentage hwEntityCpuUsage (PODS) The CPU usage ofthis entity, it calculated theoverall CPU usage on theentity

Note: PODS is anabbreviation forPerformance Metric OOTBDevice Support

HuaweiMemory Utilization

Percentage hwEntityMemUsage (PODS) The memory usagefor the entity. This objectpoint out how manypercent of memory hasbeen used.

HuaweiModule State

Number hwEntityOperStatus (PODS) The status of themodule.

HuaweiPower Supply State

Number hwEntPowerUsedInfoPower

(PODS) Used power ofboard.

HuaweiTemperature Level

Celsius hwEntityTemperature (PODS) The entitytemperature.

HuaweiVoltage Level

Voltage hwEntityVoltage (PODS) The entity voltage.



Chapter 6. Configuring Flow devices

Provides the command reference with examples for configuring the flow devices toenable them to work with IBM Network Performance Insight, Version 1.2.2.

Before Network Performance Insight can gather data, routers and other networkdevices must be configured to send NetFlow data. These configurations are neededto ensure that routers send NetFlow data periodically to the Collector subsystem.

For more detailed information about setting up flow devices for NetworkPerformance Insight, see the specific vendor documentation.

CAUTION:Only IT administrators with experience in configuring routers and switchesmust use this information.

Supported devices and flow formatsIBM Network Performance Insight, Version 1.2.2 supports most of the devices andtheir flow formats that are available in the market.

Some of devices and their flow formats that Network Performance Insight v1.2.2supports:

Device Flow format

Cisco NetFlow (v1, v5, v9, and IPFIX versions)and Flexible NetFlow with AVC

Juniper J-Flow (v5 and v9)

Alcatel Cflow (v5 and v9)

Huawei NetStream (v5 and v9)

Configuring NetFlow on Cisco routersNetflow is a data collection and reporting protocol for monitoring network trafficthat is supported by multiple vendors.

As a part of this configuration, network administrators must configure the devicesto transmit NetFlow information actively to the network monitoring applicationand configure the interfaces to gather information about the traffic conversations.The configurations that you perform must be in line with the capacity of thenetwork application. In this case, Network Performance Insight.

NetFlow also monitors layers 2-4 of Open Systems Interconnection (OSI) modeland other flow technologies and provides information on network usage and portconversations activity.Related information:

Cisco IOS Configuration Fundamentals Command Reference, Release 12.2


http://www.cisco.com/c/en/us/td/docs/ios/12_2/configfun/command/reference/ffun_r/frf001.html

Cisco IOS command modesYou use the CLI to access Cisco IOS software.

Enter a question mark (?) at the CLI prompt to obtain a list of commands that areavailable for each command mode.

When you log in to the CLI, you are in user EXEC mode. User EXEC mode containsonly a limited subset of commands. To have access to all commands, you mustenter privileged EXEC mode, normally by using a password. From privileged EXECmode, you can give any EXEC command; user or privileged mode. Or, you canenter global configuration mode.

These configuration modes are needed for you to change the runningconfiguration. If you later save the running configuration to the start configuration,these changed commands are stored when the software is rebooted. To enterspecific configuration modes, you must start at global configuration mode. Fromglobal configuration mode, you can enter interface configuration mode and variousother modes, such as protocol-specific modes.

Command modesDescribes how to use various common command modes of the Cisco IOS software.

Command modes

Shows examples of the prompts displayed.

Command mode Command

User Exec

When you log in to the CLI, you are in UserExec mode. Contains only a limited subsetof commands.

Router>

Privileged Exec

You can have access to all commands in thismode. Typically, require a password. Use theenable command. Your prompt changes toRouter#.

Router> enablePassword <password>Router#

Global configuration

Enter the configure terminal privilegedEXEC command to enter globalconfiguration mode. Your prompt changes toRouter(config)#.

Router# configure terminalRouter(config)#

Note: Enter configuration commands, oneper line. End with CTRL+Z or Exit command.

Interface configuration

From global configuration mode, specify aninterface by using an interface command.Your prompt changes toRouter(config_if)#.Note: Enter “?” to display what you mustenter next on the command line.

Router(config)# interface serial ?<0-6> Serial interface numberRouter(config)# interface serial 4 ?/Router(config)# interface serial 4/ ?<0-3> Serial interface numberRouter(config)# interface serial 4/0Router(config-if)#


Command mode Command

ROM monitor mode

ROM monitor mode is a separate mode thatis used when the Cisco IOS software cannotload properly. From privileged EXEC mode,use the reload EXEC command. Yourprompt changes to rommon #>.

Router# reload>

Configuring Flexible NetFlow and Application Visibility andControl (AVC)

Use these configuration steps to enable your devices for the mandatory Flow fieldsand the enterprise Flow fields to support AVC solution.

About this task

AVC is integrated approach that provides application recognition and performancemonitoring capabilities to your NetFlow enabled devices. The information that iscollected by Cisco AVC is exported in an open standard format such as NetflowVersion 9 and IPFIX. These formats allow both Cisco and third-party networkmanagement to support Cisco AVC solution.

The following Cisco AVC solution components are supported in NetworkPerformance Insight:v Network-Based Application Recognition (NBAR)v Next Generation Network-Based Application Recognition (NBAR2)v Application Response Time (ART)v Quality of Service (QoS)Related information:

Configuration Examples for Flexible Netflow

Configuring standard Flow fieldsThe flow record defines the record fields that must be exported from the device tothe collector.

About this task

Standard Flow fields configuration.

Procedure1. Configure to specify where the Flow data must be exported to:

configure terminalflow exporter <NPI_exporter>destination 100.100.10.10source GigabitEthernet0/3transport udp 2050export-portocol netflow-v9# Configure this option template to support application id to name and description mappingoption application table# Configure if required to support NBAR2 for application attributesoption application attributesexit

2. Configure the Flow record to collect the Flow fields:

Chapter 6. Configuring Flow devices 121

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/fnetflow/configuration/15-mt/fnf-15-mt-book/fnf-fnetflow.html#d6093e9393a1635

Note: This example is for NetFlow V9 records.configure terminalflow record type performance-monitor Netflow_v9match ipv4/ipv6 tosmatch ipv4/ipv6 protocolmatch ipv4/ipv6 source addressmatch ipv4/ipv6 destination addressmatch transport source-portmatch transport destination-portmatch interface inputmatch application namecollect interface outputcollect counter bytescollect counter packetscollect flow directioncollect routing source ascollect routing destination ascollect routing next-hop address ipv4collect transport tcp flagscollect timestamp sys-uptime firstcollect timestamp sys-uptime lastexit

3. Configure the Flow monitor that creates new NetFlow cache and the requiredFlow record and Flow Exporter:configure terminalflow monitor <NPI_monitor>description Netflow v9 monitorrecord Netflow_v9exporter <NPI_Exporter>exit

4. Configure to apply the Flow Monitor to an interface:configure terminalinterface GigabitEthernet0/3ip flow monitor <NPI_monitor> inputip flow monitor <NPI_monitor> outputexit


Cisco IOS Flexible NetFlow Command Reference

Configuring Quality of Service (QoS) on Cisco devicesQoS provides prioritization and rate-limiting of traffic. High-priority,latency-sensitive traffic can be put into the priority queue.

About this task

QoS Flow fields configuration.


configure terminalflow exporter <NPI_monitor>destination 100.100.10.10source GigabitEthernet0/3transport udp 2050export-portocol netflow-v9option application table# NBAR fields to support application id to name and description mappingoption application attributes[Configure if required to support NBAR2 for application attributesoption c3pl-policy-table


https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/fnetflow/command/fnf-cr-book.html

# Configure if required to support QoS HIeararchy and Queue Drops reportingoption c3pl-class-table# Configure if required to support QoS HIeararchy and Queue Drops reportingexit

2. Configure the Flow record to collect the QoS fields:configure terminalflow record type performance-monitor Netflow_v9match ipv4/ipv6 tosmatch ipv4/ipv6 protocolmatch ipv4/ipv6 source addressmatch ipv4/ipv6 destination addressmatch transport source-portmatch transport destination-portmatch interface inputmatch application namecollect interface outputcollect counter bytescollect counter packetscollect flow directioncollect routing source ascollect routing destination ascollect routing next-hop address ipv4collect transport tcp flagscollect policy qos class hierarchycollect policy qos queue idcollect timestamp sys-uptime firstcollect timestamp sys-uptime lastexit

a. Configure the QoS Queue Drops field collection:

Note: QoS Queue Drops must be configured in a separate Flow record asmandated by Cisco. See AVC Configuration.configure terminalflow record type performance monitor QoS_Queue_Dropmatch policy qos queue indexcollect policy qos queue dropscollect interface outputcollect timestamp absolute monitoring-interval startcollect timestamp absolute monitoring-interval endexit

3. Configure the Flow monitor that creates new NetFlow cache and the requiredFlow record and Flow Exporter:configure terminalflow monitor <NPI_monitor>description Netflow v9 monitorrecord Netflow_v9exporter <NPI_monitor>exit

a. Configure the QoS monitor:configure terminalflow monitor type performance-monitor <qos_Monitor>exporter <NPI_exporter>record QoS_Queue_Dropexit

b. Configure to create Performance Monitor Policy for QoS:

Note: Ensure that the required QoS policies and classes are defined. SeeAVC Configuration.


https://www.cisco.com/c/en/us/td/docs/ios/solutions_docs/avc/guide/avc-user-guide/avc_config.html#63427

https://www.cisco.com/c/en/us/td/docs/ios/solutions_docs/avc/guide/avc-user-guide/avc_config.html#63427

configure terminalpolicy-map type performance monitor pm-qosclass httpflow monitor qos-monitorexit

4. Configure to apply the Flow Monitor to an interface:configure terminalinterface GigabitEthernet0/3ip flow monitor NPI_monitor inputip flow monitor NPI_monitor outputservice-policy type performance monitor output pm-qosexit

Configuring Application Response Time (ART) on Cisco devicesART metrics are extracted or calculated by the ART engine. These metrics areavailable only for TCP flows.

About this task

ART Flow fields configuration.


configure terminalflow exporter NPI_exporterdestination 100.100.10.10source GigabitEthernet0/3transport udp 2050export-portocol netflow-v9option application tableoption application attributesexit

2. Configure a separate Flow record template for Application Response Time(ART) configuration as ART records contain bi-directional data:configure terminalflow record type performance-monitor ART_recordmatch ipv4/ipv6 protocolmatch application namematch connection client ipv4 addressmatch connection server ipv4 addressmatch connection server transport portcollect ipv4/ipv6 dscpcollect interface inputcollect interface outputcollect timestamp sys-uptime firstcollect timestamp sys-uptime lastcollect connection delay network to-server maxcollect connection delay network to-client maxcollect connection delay application maxcollect connection delay response client-to-server

3. Configure the Flow monitor that creates new NetFlow cache and the requiredFlow record and Flow Exporter:configure terminalflow monitor type performance-monitor ART-monitorexporter NPI_exporterrecord ART_recordexit

4. Configure to apply the Flow Monitor to an interface:


configure terminalinterface GigabitEthernet0/3ip flow monitor ART_monitor outputexit

Enabling NetFlow on your devicesTo enable NetFlow, configure IP routing and use these commands in globalconfiguration mode.

About this task

Enabling flow monitoring for an interface.

Command Description

Router(config)# interface typeslot/port-adapter/port

Enters interface configuration mode andconfigures the interface.

For example, interfaceGigabitEthernet1/0/3

Router(config-if)# ip route-cache flow Enables NetFlow for IP routing.

Router(config-if)# ip route-cache ingressRouter(config-if)# ip route-cache egressRouter(config-if)# ip flow egressRouter(config-if)# ip flow ingress

Enables NetFlow on the sub interfaces withdirection.

Configuring the Flow ExportersNetFlow information can also be exported to network management applications.

About this task

To configure a router to export NetFlow information that is maintained in theNetFlow cache to Network Performance Insight, use these commands in globalconfiguration mode. NetFlow information is exported to Network PerformanceInsight when the Flow expires in NetFlow cache.

Command Description

Router(config)# ip flow-exportip-address udp-port

Where

<IP_address>IP address of the system to which you wantto send the NetFlow information.

udp-portUDP protocol-specific port number.

Configures a router to exportNetFlow cache entries to aCollector.Note: To disable IP routing, use theno IP routing command as: no ipflow-export.


Command Description

Router(config)# ip flow-exportversion 9 [peer-as | origin-as | bgp-nexthop]

Specifies that the export packetuses the Version 9 format.Optionally, specify the origin orpeer autonomous systems.

v peer-as

Specifies that export statisticsinclude the originatingautonomous system for thesource and destination.

v origin-as

Specifies that export statisticsinclude the peer autonomoussystem for the source anddestination.

v bgp-nexthop

Specifies that export statisticsinclude BGP next hop-relatedinformation.

show ip flow export Displays statistics for the NetFlowdata export, including statistics forthe main cache and for all otherenabled caches.

Router(config)# ip flow-export source<interface>/<interface_number>

Sets the source IP address of theNetFlow exports that are sent bythe device to the specified IPaddress.

Router(config)# ip flow-cache timeout active 1 Active timeout is the frequency ofactive flow records that areexported from the flow cache toNetwork Performance Insight.Default value is 30 min. To getreal-time traffic reports, set thisvalue to 1.

Router(config)# ip flow-cache timeout inactive 15 Inactive timeout is the frequency ofinactive flow records that areexported from the flow cache toNetwork Performance Insight. Aflow record is inactive when theconversation between twointerfaces is stopped. Default valueis 15 sec.


Configuring NetFlow and NetFlow Data Export


http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/netflow/configuration/12-4t/nf-12-4t-book/cfg-nflow-data-expt.html

Customizing the number of entries in flow cacheYou can increase or decrease the number of entries that are maintained in the cacheto meet your NetFlow traffic rates. The number of entries can be 1024 - 524288.The default is 65536.

About this task

Command Description

Router(config)# ip flow-cache entries <number> Changes the number of entries thatare maintained in the NetFlowcache.

CAUTION:Improper use of this feature mightcause network problems. To returnto the default NetFlow cacheentries, use the no ip flow-cacheentries in global configurationmode.

Monitoring NetFlow informationUse these commands to verify whether the NetFlow data export is functioning anddisplaying the data.

About this task

Command Description

Router# show ip flow export Displays information aboutNetFlow flow exporters andstatistics.

Router# show flow exporter <exporter_name> Displays the statistics of thespecified Flow Exporter.

Router# show ip flow interface Displays NetFlow accountingconfiguration on interfaces.

Router# show ip interface Displays the usability status ofinterfaces that are configuredfor IP.

Router# show ip cache flow Displays the NetFlow statisticssuch as:

v IP packet size distribution

v IP flow cache information

v Flow information; protocol,total flow, flows per second

Router# clear ip flow stats Clears the NetFlow statistics.


An example Cisco device configurationCisco device configuration.configure terminalinterface serial 3/0/0ip route-cache flowexitip flow-export 127.1.0.0 0 version 5 peer-asexitclear ip flow statsRouter# show ip cache flow

The output is as shown:

IP packet size distribution (230151 total packets):1-32 64 96 128 160 192 224 256 288 320 352 384 416 448 480.999 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000512 544 576 1024 1536 2048 2560 3072 3584 4096 4608.000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000

Configuring flow on Juniper devicesProvides commands and examples to configure J-Flow on an SRX Series device.

Command modes

Command mode Description

Operational mode

When you log in to the router and type theCLI command, you are automatically inoperational mode:

user@host>

This mode displays the status of the device.In operational mode, you enter commandsto monitor and troubleshoot the Junos OS,devices, and network connectivity.

Configuration mode

user@host>configureuser@host#

To exit the mode, give the followingcommands:

user@host# commit and-quitcommit completeuser@host

To exit without commit:

user@host# exitExiting configuration modeuser@host>

A configuration for a device that is runningon Junos OS is stored as a hierarchy ofstatements. In configuration mode, you enterthese statements to define all properties ofthe Junos OS, including interfaces, generalrouting information, routing protocols, useraccess, and several system and hardwareproperties.

Active Flow monitoring

Flow monitoring versions 5, 8, and 9 support active flow monitoring. For activeflow monitoring, the monitoring station participates in the network as an activerouter. A router performs the following actions during active Flow monitoring:v Sampling

The router selects and analyzes only a portion of the traffic.v Sampling with templates


The router selects, analyzes, and arranges a portion of the traffic into templates.v Sampling per sampling instance

The router selects, analyzes, and arranges a portion of the traffic according to theconfiguration and binding of a sampling instance.

v Port mirroringThe router copies entire packets and sends the copies to another interface.

v Multiple port mirroringThe router sends multiple copies of monitored packets to multiple exportinterfaces with the next-hop-group statement at the (edit forwarding-options)hierarchy level.

v Discard accountingThe router accounts for selected traffic before it discards. Such traffic is notforwarded out of the router. Instead, the traffic is quarantined and deleted.

v Flow-tap processingThe router processes requests for active flow monitoring dynamically by usingthe Dynamic Tasking Control Protocol (DTCP).

Some of the commands for these actions are described here.Related information:

Flow Monitoring Feature Guide for Routing Devices

Active Flow Monitoring Overview

Configuring J-Flow versions 5 and 8Commands to configure J-Flow versions 5 and 8.

About this task

Commands Description

user@host# set interfaces ge-0/0/0 unit 0 familyinet sampling inputuser@host# set interfaces ge-0/0/0 unit 0 familyinet sampling output

Enables sampling on one or moreinterfaces and specify the direction.


http://www.juniper.net/documentation/en_US/junos14.2/information-products/pathway-pages/solutions/flow-monitoring/flow-monitoring.html

https://www.juniper.net/techpubs/en_US/junos14.2/topics/concept/flowmonitoring-active-overview-solutions.html


user@host# set forwarding-options samplinginput rate 100

Specifies the sampling rate.

CAUTION:Caution: Activation of flowcollection can have a significantimpact on the performance of theSRX Series device. The smallerthe sample rate, the bigger theimpact. It is recommended to notuse a sampling input rate of 1.

Where:

forwarding-optionsStarts the inline J-Flowconfiguration, so that thesampling and the J-Flowservice thread areimplemented in theforwarding engine.

samplingConfigures the J-Flowpacket sampling options.

input Enables sampling.

rate Specifies the ratio ofpackets to be sampled.

user@host# set forwarding-options sampling familyinet output flow-server 10.10.10.1 port 2056

Specifies the UDP port number ofthe host that is collecting cflowdpackets.

user@host# set forwarding-options sampling familyinet output flow-server 10.10.10.1 version 5

Specify the version format 5.


SRX Getting Started - Configure J-Flow

Configuring J-Flow version 9Commands to configure J-Flow versions 9.

About this task


user@host# set services flow-monitoring version9template v4flow-active-timeout 30

user@host# set services flow-monitoring version9template v4 flow-inactive-timeout 30

user@host# set services flow-monitoring version9template v4 <ipv4-template>

Configures the J-Flow v9template.Note: Currently, the IPv4template is supported.

user@host# set forwarding-options samplinginput rate 100

user@host# set forwarding-options samplinginput run-length 0

Specifies the sampling rateand run length.


http://kb.juniper.net/InfoCenter/index?page=content&id=KB16677


user@host# set forwarding-options samplingfamily inet output flow-server<IP_add> port 2222

user@host# set forwarding-options samplingfamily inet output flow-server <IP_address>version9 template <template_name>

Configures the externalflow collector and its portnumber.Note: The J-Flow v9template is associated withthe external flow collector.Up to eight flow collectorscan be simultaneouslyconfigured.

user@host# set forwarding-options samplinguser@host# set forwarding-options sampling inputuser@host# set forwarding-options sampling outputfamily inet output inline-jflow source-address<IP_address>

Configure the inline-jflow,so that the sampling andthe J-Flow service threadare implemented in theforwarding engine.

user@host# set interfaces ge-0/0/14 unit 0 familyinet sampling inputuser@host# set interfaces ge-1/0/0 unit 0 familyinet sampling output

user@host# set interfaces ge-0/0/14 unit 0 familyinet address <IP_address>/24

Configure the samplingfilter on an interface (orinterfaces) in the direction,on which the J-Flow serviceis required.

user@host# show interfaces descriptions Displays all the configuredinterfaces.


Juniper Flow Monitoring

Configuring the sampling instanceYou can configure active sampling by using a sampling instance and associate thatsampling instance to a particular Packet Forwarding Engine. In addition, you candefine multiple sampling instances that are associated with multiple destinations(as many as the number of Packet Forwarding Engines in the chassis), withmultiple protocol families per each sampling instance destination.

About this taskset chassis fpc 0 sampling-instance s0set interfaces ge-0/1/0 unit 0 family inet sampling inputset interfaces ge-0/1/0 unit 0 family inet addressset interfaces ge-1/0/0 unit 0 family inet addressset interfaces sp-2/0/0 unit 0 family inetset forwarding-options sampling instance s0 input rate 1set forwarding-options sampling instance s0 input run-length 0set forwarding-options sampling instance s0 family inet output

flow-server 2.2.2.2 port 2055set forwarding-options sampling instance s0 family inet output

flow-server 2.2.2.2 version9 template v4;set forwarding-options sampling instance s0 family inet output

interface sp-2/0/0 source-address 1.1.1.1set routing-options static route 50.0.0.0/8 next-hop 20.0.0.2set services flow-monitoring version9 template v4 flow-active-timeout 30set services flow-monitoring version9 template v4 flow-inactive-timeout 30set services flow-monitoring version9 template v4 ipv4-template


Example: Sampling Instance Configuration


http://kb.juniper.net/library/CUSTOMERSERVICE/GLOBAL_JTAC/BK16677/3500204-en.pdf

http://www.juniper.net/documentation/en_US/junos12.1/topics/example/flowmonitoring-active-sampling-instance-example.html

Configuring J-Flow version 9 for SRX-DataCenter devicesCommands to configure J-Flow versions 9 for SRX-DataCenter devices.

About this task


user@host# set services flow-monitoring version9template <template_name>

Configures the J-Flow v9 template

user@host# set samplng family inet outputflow server <flow_collector_ip_add>port <flow_collector_port>version9 template <template_name>

Configures external flow collector, inthis case, Network PerformanceInsight Collector.

user@host# set forwarding-options samplinginstance <instance1>input rate 100

user@host# set forwarding-options samplinginstance <instance1> inputrun-length 0

Specifies the sampling rate.Note: Currently, IPv4 template issupported.

user@host# set forwarding-options samplinginstance instance1 family inetoutput flow-server <Ip_address> port 2222

user@host# set forwarding-options samplinginstance instance1 family inetoutput flow-server <Ip_address> version9template <template_name>

Configures the external flowcollector and its port address.Note: The J-Flow v9 template isassociated with the external flowcollector. Up to eight flow collectorscan be simultaneously configured.

user@host# set forwarding-options samplinginstance instance1 family inet outputinline-jflow source-address <Ip_address>

Configures the inline-jflow, so thatthe sampling and the J-Flow servicethread are implemented in theforwarding engine.

user@host# set interfaces ge-0/0/14 unit 0family inet sampling inputuser@host# set interfaces ge-0/0/14 unit 0family inet address 2.2.2.1/24

Configures the sampling filter on aninterface (or interfaces) in thedirection, on which the J-Flowservice is required.


SRX Getting Started - Configure J-Flow

Using the show commandsDescribes the possible show command options in configuration mode andOperational mode.

About this taskconfigure//To enter a configuration modeshow ?


http://kb.juniper.net/InfoCenter/index?page=content&id=KB16677

<[Enter]> Execute this command> access Network access configuration> access-profile Access profile for this instance> accounting-options Accounting data configuration> applications Define applications by protocol characteristics+ apply-groups Groups from which to inherit configuration data> chassis Chassis configuration> class-of-service Class-of-service configuration> ethernet-switching-options Ethernet-switching configuration options> event-options Event processing configuration> firewall Define a firewall configuration> forwarding-options Configure options to control packet forwarding> groups Configuration groups> interfaces Interface configuration> multi-chassis> multicast-snooping-options Multicast snooping option configuration> policy-options Policy option configuration> protocols Routing protocol configuration> routing-instances Routing instance configuration> routing-options Protocol-independent routing option configuration> schedulers Security scheduler> security Security configuration> services Set services parameters> smtp Simple Mail Transfer Protocol service configuration> snmp Simple Network Management Protocol configuration> system System parameters> vlans VLAN configuration

| Pipe through a command

Exit//To exit the configuration modeShow// To run the show command options in User Excec mode


accounting Show accounting profiles and recordsarp Show system Address Resolution Protocol table entriesas-path Show table of known autonomous system pathsauthentication-whitelist Show 802.1X White List MAC addressesbfd Show Bidirectional Forwarding Detection informationbgp Show Border Gateway Protocol informationchassis Show chassis informationclass-of-service Show class-of-service (CoS) informationcli Show command-line interface settingsconfiguration Show current configurationconnections Show circuit cross-connect connectionsdatabase-replication Show database replication informationdhcp Show Dynamic Host Configuration Protocol informationdhcpv6 Show Dynamic Host Configuration Protocol v6 informationdialer Show dialer informationdot1x Show 802.1X informationdvmrp Show Distance Vector Multicast Routing Protocol informationdynamic-tunnels Show dynamic tunnel information informationesis Show end system-to-intermediate system informationethernet-switching Show Ethernet-switching informationevent-options Show event-options informationfirewall Show firewall informationforwarding-options Show forwarding-options informationgvrp Show Generic VLAN Registration Protocol informationhelper Show port-forwarding helper informationhfrr Show information related to Host (Direct route) Fast reroutehost Show hostname information from domain name servericcp Show Inter Chassis Control Protocol informationigmp Show Internet Group Management Protocol informationigmp-snooping Show IGMP snooping informationingress-replication Show Ingress-Replication tunnel informationinterfaces Show interface informationipv6 Show IP version 6 informationisdn Show Integrated Services Digital Network informationisis Show Intermediate System-to-Intermediate System informationl2circuit Show Layer 2 circuit informationl2vpn Show Layer 2 VPN informationlacp Show Link Aggregation Control Protocol informationldp Show Label Distribution Protocol informationlldp Show Link Layer Discovery Protocol informationlog Show contents of log filemld Show multicast listener discovery informationmld-snooping Show MLD snooping informationmpls Show mpls informationmsdp Show Multicast Source Discovery Protocol informationmulticast Show multicast informationmvpn Show Multicast Virtual Private Network (MVPN) informationnetwork-access Show network-access related informationntp Show Network Time Protocol informationoam Show OAM-related informationospf Show Open Shortest Path First informationospf3 Show Open Shortest Path First version 3 informationpfe Show Packet Forwarding Engine informationpgm Show Pragmatic Generalized Multicast informationpim Show Protocol Independent Multicast informationpolicer Show interface policer counters and informationpolicy Show policy informationppp Show PPP process informationpppoe Show PPP over Ethernet informationr2cp Show Radio-to-Router Protocol informationrip Show Routing Information Protocol informationripng Show Routing Information Protocol for IPv6 informationroute Show routing table informationrsvp Show Resource Reservation Protocol informationsap Show Session Announcement Protocol informationschedulers Show the information on one or more schedulerssecurity Show security informationservices Show servicessmtp Show Simple Mail Transfer Protocol informationsnmp Show Simple Network Management Protocol informationspanning-tree Show Spanning Tree Protocol informationsystem Show system informationtask Show routing protocol per-task informationted Show Traffic Engineering Database informationtgm Show telephony gateway module informationversion Show software process revision levelsvlans Show VLAN informationvpls Show VPLS informationvrrp Show Virtual Router Redundancy Protocol informationwan-acceleration Show WAN acceleration module information


Verifying the configuration with show commandsTo verify that your configuration is correct, use these commands on the monitoringstation that is configured for active flow monitoring.

About this taskshow servicesshow services flow-monitoringshow services flow-monitoring version9 template <template_name>show services accounting errorsshow services accounting (flow | flow-detail)show services accounting memoryshow services accounting packet-size-distributionshow services accounting statusshow services accounting usageshow services accounting aggregation template template-namename (detail | extensive | terse)

Most active flow monitoring operational mode commands contain equivalentoutput information to the following passive flow monitoring commands:show services accounting errors = show passive-monitoring errorshow services accounting flow = show passive-monitoring flowshow services accounting memory = show passive-monitoring memoryshow services accounting status = show passive-monitoring statusshow services accounting usage = show passive-monitoring usage

The active flow monitoring commands can be used with most active flowmonitoring applications, including sampling, discard accounting, port mirroring,and multiple port mirroring. The following command shows the output of theshow commands that are used with the configuration example:user@router> show services accounting errors

Service Accounting interface: sp-2/0/0, Local interface index: 542Service name: (default sampling)Error information

Packets dropped (no memory): 0, Packets dropped (not IP): 0Packets dropped (not IPv4): 0, Packets dropped (header too small): 0Memory allocation failures: 0, Memory free failures: 0Memory free list failures: 0Memory overload: No, PPS overload: No, BPS overload: Yes

user@router> show services accounting flow-detail limit 10

Service Accounting interface: sp-2/0/0, Local interface index: 468Service name: (default sampling)Protocol Source Source Destination Destination Packet Byte

Address Port Address Port count countudp(17) 10.1.1.2 53 10.0.0.1 53 4329 3386035ip(0) 10.1.1.2 0 10.0.0.2 0 4785 3719654ip(0) 10.1.1.2 0 10.0.1.2 0 4530 3518769udp(17) 10.1.1.2 0 10.0.7.1 0 5011 3916767tcp(6) 10.1.1.2 20 10.3.0.1 20 1 1494tcp(6) 10.1.1.2 20 10.168.80.1 20 1 677tcp(6) 10.1.1.2 20 10.69.192.1 20 1 446tcp(6) 10.1.1.2 20 10.239.240.1 20 1 1426tcp(6) 10.1.1.2 20 10.126.160.1 20 1 889tcp(6) 10.1.1.2 20 10.71.224.1 20 1 1046

user@router> show services accounting memory


Service Accounting interface: sp-2/0/0, Local interface index: 468Service name: (default sampling)Memory utilization

Allocation count: 437340, Free count: 430681, Maximum allocated: 6782Allocations per second: 3366, Frees per second: 6412Total memory used (in bytes): 133416928, Total memory free (in bytes): 133961744

user@router> show services accounting packet-size-distribution

Service Accounting interface: sp-2/0/0, Local interface index: 468Service name: (default sampling)Range start Range end Number of packets Percentage packets

64 96 1705156 100

user@router> show services accounting status

Service Accounting interface: sp-2/0/0, Local interface index: 468Service name: (default sampling)Interface state: MonitoringGroup index: 0Export interval: 60 secs, Export format: cflowd v5Protocol: IPv4, Engine type: 55, Engine ID: 5Route record count: 13, IFL to SNMP index count: 30, AS count: 1Time set: Yes, Configuration set: YesRoute record set: Yes, IFL SNMP map set: Yes

user@router> show services accounting usage

Service Accounting interface: sp-2/0/0, Local interface index: 468Service name: (default sampling)CPU utilizationUptime: 4790345 milliseconds, Interrupt time: 1668537848 microsecondsLoad (5 second): 71%, Load (1 minute): 63%


Verifying Your Work

Viewing device configurationAn example configuration for the J-Flow v9 template ipv4-test, flow collector172.19.101.85 (port 2222) with sampling rate 1:100 and run length as 0.

For example, to view the configuration for the following set commands:set services flow-monitoring version9 template ipv4-test ipv4-templateset forwarding-options sampling input rate 1set forwarding-options sampling input run-length 0set forwarding-options sampling family inet output flow-server 172.19.101.85 port2222set forwarding-options sampling family inet output flow-server 172.19.101.85version9 template ipv4-testset forwarding-options sampling family inet output inline-jflow source-address172.19.101.132set interfaces ge-0/0/14 unit 0 family inet sampling inputset interfaces ge-0/0/14 unit 0 family inet address 23.23.23.1/24

Give this command to view the details:show configuration


https://www.juniper.net/techpubs/en_US/junos14.2/topics/example/flowmonitoring-active-sampling-solutions.html

Configuring NetStream traffic on Huawei devicesHuawei devices support NetStream flow, which is a supported flow type inNetwork Performance Insight.Related information:

NetStream (Integrated) Technology White Paper

Configuring NetStream exportHuawei NetStream works much like Cisco NetFlow. The NetStream processgathers detailed data about flows and stores them to a cache table. NetStream thenprocesses the flow data from the cache table and sends it to Network PerformanceInsight for monitoring.

About this task

There are export options for flow sampling, aggregation, and flow record contentdepending on how and what you are monitoring and how you need to export andreport.


[RouterA] ip NetStream export host <hostname>|<ip_address> 9996

Enables NetStream onHuawei devices

ip NetStream export source interface <interface_name> Exports the NetStreamdata to a specified IPaddress.

[RouterA] ip NetStream sampler inbound 100

[RouterA] ip NetStream sampler outbound 100

Configures globalsampling.

[RouterA] interface gigabitethernet 1/0/0

[RouterA-GigabitEthernet1/0/0] ip address<IP_address1> <IP_address2>

Sets up an interface.

[RouterA-GigabitEthernet1/0/0] ip NetStream inbound

[RouterA-GigabitEthernet1/0/0] ip NetStream outbound

Enables NetStreamstatistics on the inboundand outbound interfaces


http://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=4&ved=0CEYQFjAD&url=http%3A%2F%2Fenterprise.huawei.com%2Filink%2Fenenterprise%2Fdownload%2FHW_201022&ei=WGhhVa3-Ls-QuATio4CgBw&usg=AFQjCNHak9rRt0lH2vgXGVNZNTnh1Q2Gig&bvm=bv.93990622,d.c2E&cad=rja


Notices

This information was developed for products and services offered in the US. Thismaterial might be available from IBM in other languages. However, you may berequired to own a copy of the product or product version in that language in orderto access it.

IBM may not offer the products, services, or features discussed in this document inother countries. Consult your local IBM representative for information on theproducts and services currently available in your area. Any reference to an IBMproduct, program, or service is not intended to state or imply that only that IBMproduct, program, or service may be used. Any functionally equivalent product,program, or service that does not infringe any IBM intellectual property right maybe used instead. However, it is the user's responsibility to evaluate and verify theoperation of any non-IBM product, program, or service.

IBM may have patents or pending patent applications covering subject matterdescribed in this document. The furnishing of this document does not grant youany license to these patents. You can send license inquiries, in writing, to:

IBM Director of LicensingIBM CorporationNorth Castle Drive, MD-NC119Armonk, NY 10504-1785US

For license inquiries regarding double-byte character set (DBCS) information,contact the IBM Intellectual Property Department in your country or sendinquiries, in writing, to:

Intellectual Property LicensingLegal and Intellectual Property LawIBM Japan Ltd.19-21, Nihonbashi-Hakozakicho, Chuo-kuTokyo 103-8510, Japan

INTERNATIONAL BUSINESS MACHINES CORPORATION PROVIDES THISPUBLICATION "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHEREXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIEDWARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY OR FITNESSFOR A PARTICULAR PURPOSE. Some jurisdictions do not allow disclaimer ofexpress or implied warranties in certain transactions, therefore, this statement maynot apply to you.

This information could include technical inaccuracies or typographical errors.Changes are periodically made to the information herein; these changes will beincorporated in new editions of the publication. IBM may make improvementsand/or changes in the product(s) and/or the program(s) described in thispublication at any time without notice.

Any references in this information to non-IBM websites are provided forconvenience only and do not in any manner serve as an endorsement of those


websites. The materials at those websites are not part of the materials for this IBMproduct and use of those websites is at your own risk.

IBM may use or distribute any of the information you provide in any way itbelieves appropriate without incurring any obligation to you.

Licensees of this program who wish to have information about it for the purposeof enabling: (i) the exchange of information between independently createdprograms and other programs (including this one) and (ii) the mutual use of theinformation which has been exchanged, should contact:

IBM Director of LicensingIBM CorporationNorth Castle Drive, MD-NC119Armonk, NY 10504-1785US

Such information may be available, subject to appropriate terms and conditions,including in some cases, payment of a fee.

The licensed program described in this document and all licensed materialavailable for it are provided by IBM under terms of the IBM Customer Agreement,IBM International Program License Agreement or any equivalent agreementbetween us.

The performance data discussed herein is presented as derived under specificoperating conditions. Actual results may vary.

The client examples cited are presented for illustrative purposes only. Actualperformance results may vary depending on specific configurations and operatingconditions.

Information concerning non-IBM products was obtained from the suppliers ofthose products, their published announcements or other publicly available sources.IBM has not tested those products and cannot confirm the accuracy ofperformance, compatibility or any other claims related to non-IBM products.Questions on the capabilities of non-IBM products should be addressed to thesuppliers of those products.

Statements regarding IBM's future direction or intent are subject to change orwithdrawal without notice, and represent goals and objectives only.

All IBM prices shown are IBM's suggested retail prices, are current and are subjectto change without notice. Dealer prices may vary.

This information is for planning purposes only. The information herein is subject tochange before the products described become available.

This information contains examples of data and reports used in daily businessoperations. To illustrate them as completely as possible, the examples include thenames of individuals, companies, brands, and products. All of these names arefictitious and any similarity to actual people or business enterprises is entirelycoincidental.

COPYRIGHT LICENSE:


This information contains sample application programs in source language, whichillustrate programming techniques on various operating platforms. You may copy,modify, and distribute these sample programs in any form without payment toIBM, for the purposes of developing, using, marketing or distributing applicationprograms conforming to the application programming interface for the operatingplatform for which the sample programs are written. These examples have notbeen thoroughly tested under all conditions. IBM, therefore, cannot guarantee orimply reliability, serviceability, or function of these programs. The sampleprograms are provided "AS IS", without warranty of any kind. IBM shall not beliable for any damages arising out of your use of the sample programs.

Each copy or any portion of these sample programs or any derivative work mustinclude a copyright notice as follows:

© (your company name) (year).Portions of this code are derived from IBM Corp. Sample Programs.© Copyright IBM Corp. _enter the year or years_.

TrademarksIBM, the IBM logo, and ibm.com are trademarks or registered trademarks ofInternational Business Machines Corp., registered in many jurisdictions worldwide.Other product and service names might be trademarks of IBM or other companies.A current list of IBM trademarks is available on the web at "Copyright andtrademark information" at www.ibm.com/legal/copytrade.shtml.

Adobe, Acrobat, PostScript and all Adobe-based trademarks are either registeredtrademarks or trademarks of Adobe Systems Incorporated in the United States,other countries, or both.

IT Infrastructure Library is a registered trademark of the Central Computer andTelecommunications Agency which is now part of the Office of GovernmentCommerce.

Intel, Intel logo, Intel Inside, Intel Inside logo, Intel Centrino, Intel Centrino logo,Celeron, Intel Xeon, Intel SpeedStep, Itanium, and Pentium are trademarks orregistered trademarks of Intel Corporation or its subsidiaries in the United Statesand other countries.

Linux is a registered trademark of Linus Torvalds in the United States, othercountries, or both

Microsoft and Windows are trademarks of Microsoft Corporation in the UnitedStates, other countries, or both.

ITIL is a registered trademark, and a registered community trademark of TheMinister for the Cabinet Office, and is registered in the U.S. Patent and TrademarkOffice.

UNIX is a registered trademark of The Open Group in the United States and othercountries.

Java and all Java-based trademarks and logosare trademarks or registered trademarks ofOracle and/or its affiliates.

Notices 141

http://www.ibm.com/legal/us/en/copytrade.shtml

Cell Broadband Engine is a trademark of Sony Computer Entertainment, Inc. in theUnited States, other countries, or both and is used under license therefrom.

Linear Tape-Open, LTO, the LTO Logo, Ultrium, and the Ultrium logo aretrademarks of HP, IBM Corp. and Quantum in the U.S. and other countries.

Terms and conditions for product documentationPermissions for the use of these publications are granted subject to the followingterms and conditions.

Applicability

These terms and conditions are in addition to any terms of use for the IBMwebsite.

Personal use

You may reproduce these publications for your personal, noncommercial useprovided that all proprietary notices are preserved. You may not distribute, displayor make derivative work of these publications, or any portion thereof, without theexpress consent of IBM.

Commercial use

You may reproduce, distribute and display these publications solely within yourenterprise provided that all proprietary notices are preserved. You may not makederivative works of these publications, or reproduce, distribute or display thesepublications or any portion thereof outside your enterprise, without the expressconsent of IBM.

Rights

Except as expressly granted in this permission, no other permissions, licenses orrights are granted, either express or implied, to the publications or anyinformation, data, software or other intellectual property contained therein.

IBM reserves the right to withdraw the permissions granted herein whenever, in itsdiscretion, the use of the publications is detrimental to its interest or, asdetermined by IBM, the above instructions are not being properly followed.

You may not download, export or re-export this information except in fullcompliance with all applicable laws and regulations, including all United Statesexport laws and regulations.

IBM MAKES NO GUARANTEE ABOUT THE CONTENT OF THESEPUBLICATIONS. THE PUBLICATIONS ARE PROVIDED "AS-IS" AND WITHOUTWARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDINGBUT NOT LIMITED TO IMPLIED WARRANTIES OF MERCHANTABILITY,NON-INFRINGEMENT, AND FITNESS FOR A PARTICULAR PURPOSE.


Notices 143

IBM®

Printed in USA

Date post:	10-Aug-2020
Category:	Documents
Upload:	others
View:	2 times
Download:	0 times

with IBM Corp. · 2018-02-02 · – ZooKeeper Note: Because Zookeeper r equir es a majority , it...

Documents