IBM. Netcool /Proviso 4.3-X. Tivoli. NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide. Document Revision R2E1

Tivoli Netcool /Proviso 4.3-X IBM Document Revision R2E1 NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide

Notices This information was developed for products and services offered in the U.S.A. IBM may not offer the products, services, or features discussed in this document in other countries. Consult your local IBM representative for information about the products and services currently available in your area. Any reference to an IBM product, program, or service is not intended to state or imply that only that IBM product, program, or service may be used. Any functionally equivalent product, program, or service that does not infringe any IBM intellectual property right may be used instead. However, it is the user s responsibility to evaluate and verify the operation of any non-ibm product, program, or service. IBM may have patents or pending patent applications covering subject matter described in this document. The furnishing of this document does not give you any license to these patents. You can send license inquiries, in writing, to: IBM Director of Licensing IBM Corporation North Castle Drive Armonk, NY 10504-1785 U.S.A. For license inquiries regarding double-byte (DBCS) information, contact the IBM Intellectual Property Department in your country or send inquiries, in writing, to: IBM World Trade Asia Corporation Licensing 2-31 Roppongi 3-chome, Minato-ku Tokyo 106, Japan The following paragraph does not apply to the United Kingdom or any other country where such provisions are inconsistent with local law: INTERNATIONAL BUSINESS MACHINES CORPORATION PROVIDES THIS PUBLICATION "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Some states do not allow disclaimer of express or implied warranties in certain transactions, therefore, this statement might not apply to you. This information could include technical inaccuracies or typographical errors. Changes are periodically made to the information herein; these changes will be incorporated in new editions of the publication. IBM may make improvements and/or changes in the product(s) and/or the program(s) described in this publication at any time without notice. Any references in this information to non-ibm Web sites are provided for convenience only and do not in any manner serve as an endorsement of those Web sites. The materials at those Web sites are not part of the materials for this IBM product and use of those Web sites is at your own risk. IBM may use or distribute any of the information you supply in any way it believes appropriate without incurring any obligation to you. Licensees of this program who wish to have information about it for the purpose of enabling: (i) the exchange of information between independently created programs and other programs (including this one) and (ii) the mutual use of the information which has been exchanged, should contact: IBM Corporation 2Z4A/101 11400 Burnet Road Austin, TX 78758 U.S.A. Such information may be available, subject to appropriate terms and conditions, including in some cases payment of a fee. The licensed program described in this document and all licensed material available for it are provided by IBM under terms of the IBM Customer Agreement, IBM International Program License Agreement or any equivalent agreement between us. Any performance data contained herein was determined in a controlled environment. Therefore, the results obtained in other operating environments may vary significantly. Some measurements may have been made on development-level systems and there is no guarantee that these measurements will be the same on generally available systems. Furthermore, some measurement may have been estimated through extrapolation. Actual results may vary. Users of this document should verify the applicable data for their specific environment. Information concerning non-ibm products was obtained from the suppliers of those products, their published announcements or other publicly available sources. IBM has not tested those products and cannot confirm the accuracy of performance, compatibility or any other claims related to non-ibm products.

Questions on the capabilities of non-ibm products should be addressed to the suppliers of those products. All statements regarding IBM s future direction or intent are subject to change or withdrawal without notice, and represent goals and objectives only. This information is for planning purposes only. The information herein is subject to change before the products described become available. This information contains examples of data and reports used in daily business operations. To illustrate them as completely as possible, the examples include the names of individuals, companies, brands, and products. All of these names are fictitious and any similarity to the names and addresses used by an actual business enterprise is entirely coincidental. COPYRIGHT LICENSE: This information contains sample application programs in source language, which illustrate programming techniques on various operating systems. You may copy, modify, and distribute these sample programs in any form without payment to IBM, for the purposes of developing, using, marketing or distributing application programs conforming to the application programming interface for the operating system for which the sample programs are written. These examples have not been thoroughly tested under all conditions. IBM, therefore, cannot guarantee or imply reliability, serviceability, or function of these programs. You may copy, modify, and distribute these sample programs in any form without payment to IBM for the purposes of developing, using, marketing, or distributing application programs conforming to IBM's application programming interfaces. If you are viewing this information in softcopy form, the photographs and color illustrations might not appear. Trademarks AIX, DB2, developerworks, eserver, i5/os, IBM, the IBM logo, IBMLink, iseries, Lotus, Netcool, Netcool/Proviso, OMEGAMON, Passport Advantage, pseries, Rational, Redbooks, OS/390, OS/400, Tivoli, the Tivoli logo, Tivoli Enterprise Console, WebSphere, and zseries are trademarks or registered trademarks of International Business Machines Corporation in the United States, other countries, or both. Intel is a registered trademark of Intel Corporation or its subsidiaries in the United States, other countries, or both. Linux is a trademark of Linus Torvalds in the United States, other countries, or both. Microsoft, Windows, Windows NT, and the Windows logo are trademarks of Microsoft Corporation in the United States, other countries, or both. Java and all Java-based trademarks and logos are trademarks or registered trademarks of Sun Microsystems, Inc. in the United States, other countries, or both. UNIX is a registered trademark of The Open Group in the United States and other countries. Other company, product, and service names may be trademarks or service marks of others. Copyright IBM Corp. 2009. US Government Users Restricted Rights Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp.

Contents Preface........................................................................................ ix Audience.......................................................................... ix Organization....................................................................... ix Chapter 1: Introduction..................................................................... 1 Overview.......................................................................... 1 How is the Data Collected?........................................................... 1 Inventory....................................................................... 1 Collection...................................................................... 2 How is the Data Processed and Loaded into the Database?................................. 2 CME Operation................................................................. 3 How is the Data Reported?........................................................... 3 Chapter 2:Supported Reports.............................................................. 5 Overview.......................................................................... 5 Reporter Sets....................................................................... 5 Reporter Set Tree................................................................ 5 Reports........................................................................... 6 Throughput Summary Group......................................................... 7 Throughput Summary Resource....................................................... 9 TopN ToS Summary Group.......................................................... 10 Traffic Summary Group............................................................. 11 Traffic Summary Resource........................................................... 13 Chapter 3: Devices and Services.......................................................... 15 Overview......................................................................... 15 Summary of Device Technology...................................................... 15 Technology Pack Overview.......................................................... 16 Components and Data Flow......................................................... 16 Aurora Netflow Collector........................................................ 16 Configuration File.................................................................. 17 Input Files........................................................................ 17 Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X v

Contents Chapter 4: Element and Sub-Element Properties........................................19 Overview......................................................................... 19 NetFlow IPFIX Device Element Properties............................................. 19 NetFlow IPFIX Device Sub-Element Properties......................................... 19 Element.STATE................................................................... 20 NF_Application................................................................... 21 NF_DestIPAddress................................................................. 22 NF_DestIPAsNumber.............................................................. 23 NF_DestMask..................................................................... 24 NF_DestNet...................................................................... 25 NF_DestPort...................................................................... 26 NF_DstAsNum.................................................................... 27 NF_InputIFIndex.................................................................. 28 NF_NetworkName................................................................. 29 NF_NextHop..................................................................... 30 NF_OutputIFIndex................................................................ 31 NF_Protocol...................................................................... 32 NF_Router....................................................................... 33 NF_Site.......................................................................... 34 NF_SourceIPAddress............................................................... 35 NF_SourceIPAsNumber............................................................ 36 NF_SourceMask................................................................... 37 NF_SourceNet.................................................................... 38 NF_SourcePort.................................................................... 39 NF_SrcAsNum.................................................................... 40 NF_TCPFlags..................................................................... 41 NF_Topic........................................................................ 42 NF_Tos.......................................................................... 43 STATE........................................................................... 44 Chapter 5: Sub-Element Grouping Rules.................................................45 Overview......................................................................... 45 NOC Reporting Grouping Rules...................................................... 46 Sub-Element Collect Grouping Rules.................................................. 49 vi Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X

Contents Chapter 6: Defined Resources............................................................. 51 Overview......................................................................... 51 NetFlow IPFIX Technology Pack Elements............................................. 51 NetFlow IPFIX Technology Pack Sub-Elements......................................... 51 Tables of Sub-Element Types..................................................... 52 Networks...................................................................... 53 NetApp....................................................................... 54 ASNum....................................................................... 55 NetMatrix..................................................................... 56 NetHost....................................................................... 57 HostNet....................................................................... 58 NetToS....................................................................... 59 Chapter 7: Bulk Collection Formulas..................................................... 61 Overview......................................................................... 61 Data Collection.................................................................... 61 Formulas and Metrics............................................................... 62 Formula Reference................................................................. 62 Bytes (throughput)................................................................. 63 Bytes In (throughput)............................................................... 64 Bytes In.......................................................................... 65 Bytes Out (throughput)............................................................. 66 Bytes Out........................................................................ 67 Bytes............................................................................ 68 BytesTotal........................................................................ 69 Flows............................................................................ 70 Packets (throughput)................................................................ 71 Packets In (throughput)............................................................. 72 Packets In........................................................................ 73 Packets Out (throughput)............................................................ 74 Packets Out....................................................................... 75 Packets........................................................................... 76 PacketsTotal....................................................................... 77 Appendix A: Configuration................................................................ 79 Overview......................................................................... 79 Before You Begin.................................................................. 79 Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X vii

Contents Configure the Technology Pack....................................................... 80 Other Tasks and Considerations...................................................... 89 Verify Resources................................................................ 89 Appendix B: UBA Parameters Reference (Netcool/Proviso 443 and Higher).........91 UBA Parameters Reference.......................................................... 91 Custom Parameters................................................................ 127 Enabling Host reporting............................................................ 128 Appendix C: Template File Reference (Pre-443 Only)................................. 129 Pack-Specific UBA Parameters....................................................... 130 Appendix D: Aurora Netflow Collector Installation and Configuration............. 135 Overview........................................................................ 135 Deployment Considerations......................................................... 135 Topology..................................................................... 135 Duplication................................................................... 136 Scalability..................................................................... 136 Aurora Installation................................................................ 137 Aurora Configuration.............................................................. 138 Configuration By Means of Aurora Script........................................... 141 Aurora Configuration and Load Balancing.......................................... 144 Additional Copyright Information....................................................... 147 viii Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X

Preface This manual describes the Netcool/Proviso NetFlow IPFIX Technology Pack, focusing on the NetFlow IPFIX environment. Specifically, the manual describes the reports for displaying information about the devices and technologies that operate in the NetFlow IPFIX environment. The manual also describes the data collection model, properties, resources, collection formulas, and metrics that the NetFlow IPFIX Technology Pack provides to create the associated reporter sets. Audience The audiences for this manual are the network administration engineers at IBM customer sites who will install, configure, and use the NetFlow IPFIX Technology Pack as part of their Netcool/Proviso installation. IBM Professional Services engineers may also find this manual useful. To install and use the NetFlow IPFIX Technology Pack, you should have a working knowledge of the following subjects: Netcool/Proviso DataMart TCP/IP networks Telecom network management Administration of the operating system The audiences should also be familiar with the specific technology that the NetFlow IPFIX Technology Pack deals with, in this case NetFlow IPFIX. Organization This guide is organized as follows: Chapter 1, Introduction Provides a general introduction to technology packs. Chapter 2, Supported Reports Provides information about the reports that the NetFlow IPFIX Technology Pack provides for each device operating in the NetFlow IPFIX environment. Chapter 3, Devices and Services Describes the devices and services that the NetFlow IPFIX Technology Pack supports. Chapter 4, Element and Sub-Element Properties Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X ix

Preface Describes the properties that the NetFlow IPFIX Technology Pack discovers during the inventory process. Chapter 5, Sub-Element Grouping Rules Describes the sub-element collection grouping rules and the NOC reporting grouping rules that the NetFlow IPFIX Technology Pack defines. Chapter 6, Defined Resources Provides information about the elements and sub-elements that the technology pack defines in the Proviso database. Chapter 7, Bulk Collection Formulas Provides information about the Bulk collection formulas that the NetFlow IPFIX Technology Pack provides for devices operating in the NetFlow IPFIX environment that generate and store data in Bulk input files. Specifically, the chapter discusses the metrics on which the Bulk collection formulas operate. Appendix A, Configuration Describes how to configure the NetFlow IPFIX Technology Pack. Appendix B, UBA Parameters Reference (Netcool/Proviso 443 and Higher) Provides UNIX reference pages for each of the pack-specific UBA parameters supplied with the XSD file for the NetFlow IPFIX Technology Pack. Appendix C, Template File Reference (Pre-443 Only) Explains the edits (using a text editor) that need to be made to pack-specific UBA parameters delivered in the pack s template file. Appendix D, Aurora Netflow Collector Installation and Configuration Provides instructions for installing, configuring, and running the Aurora Netflow Collector. The Netcool/Proviso Product Suite Netcool/Proviso is made up of the following components: Netcool/Proviso DataMart is a set of management, configuration and troubleshooting GUIs that the Netcool/Proviso System Administrator uses to define policies and configuration, as well as verify and troubleshoot operations. Netcool/Proviso DataLoad provides flexible, distributed data collection and data import of SNMP and non-snmp data to a centralized database. Netcool/Proviso DataChannel aggregates the data collected through Netcool/Proviso DataLoad for use by the Netcool/Proviso DataView reporting functions. It also processes on-line calculations and detects realtime threshold violations. Netcool/Proviso DataView is a reliable application server for on-demand, web-based network reports. Netcool/Proviso Technology Packs extend the Netcool/Proviso system with service-ready reports for network operations, business development, and customer viewing. The following figure shows the different Netcool/Proviso modules. x Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X

Preface Figure 1: Netcool/Proviso Modules DataLoad collects network data. DataChannel computes aggregations and stores data in DataMart. DataMart provides data management and applications. DataView produces and manages reports. Netcool/Proviso documentations consists of the following: release notes configuration recommendations user guides technical notes online help The documentation is available for viewing and downloading on the infocenter at: http://publib.boulder.ibm.com/infocenter/tivihelp/v8r1/index.jsp?topic=/com.ibm.netcool_proviso.doc/welcome.htm Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X xi

Preface xii Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X

Chapter 1: Introduction This chapter discusses the following topics: Topic Page Overview 1 How is the Data Collected? 1 How is the Data Processed and Loaded into the Database? 2 How is the Data Reported? 3 Overview Netcool/Proviso Technology Packs are individually installed modules that contain discovery, grouping, collection, and reporting instructions created by Technology Pack developers or Professional Services personnel for a specific network technology or network equipment provider, such as NetFlow IPFIX. Once installed, a Technology Pack programs Netcool/Proviso to inventory and group specific network resources, perform mathematical calculations on raw or aggregated data streams collected from these resources, and produce key performance monitoring metrics that are stored on the Netcool/Proviso database. Reporter sets designed for each Technology Pack query the database for this information and display the results on a web portal in the form of specialized report tables, graphs, and charts. This chapter provides an overview of how Technology Packs work with Netcool/Proviso to collect, process, load, and report data from a network environment. How is the Data Collected? Inventory After a Netcool/Proviso Technology Pack has been installed, an inventory process must be run so that the Technology Pack s target network resources can be identified and modeled within Netcool/Proviso as subelements. Sub-elements must be created before data from any network resource can be collected, processed, and stored in the database. How sub-elements are discovered depends on whether the target resources are SNMP resources or non-snmp resources: For SNMP network resources, a Technology Pack provides a discovery formula. Discovery formulas are used to evaluate network resources, determine which resources become sub-elements, and set values for items defined as properties in the formula. Once all the sub-elements have been discovered and created in the database, the inventory process organizes the sub-elements according to the grouping rules provided by a Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 1

Chapter 1: Introduction Technology Pack. The grouping rules use the properties and values defined within inventory formulas or adaptor design files to filter the sub-elements into their appropriate collection or reporting groups. For non-snmp network resources, a Technology Pack provides a Bulk Adaptor Design File. Bulk Adaptor Design Files define how data fields that reside in files generated by network resources are used to create subelements and set values for items defined as properties. During the database synchronization phase of the inventory process, the list of discovered sub-elements is compared to what exists in the database. Newly discovered sub-elements are assigned a resource identifier (RID) and timestamp, and the database uses both items to create a new entry for the sub-element to reflect the known state of the network inventory. Collection Following the completion of the inventory process, Netcool/Proviso is ready to collect performance data for a Technology Pack s target network resources. A Technology Pack provides Netcool/Proviso with collection formulas that instruct a DataLoad collector residing in a DataChannel to collect specific types of performance data against a particular sub-element. The types of collection formulas applied to the data depend on whether the sub-element is an SNMP resource or non-snmp resource: For SNMP network resources, a Technology Pack provides SNMP collection formulas. SNMP collection formulas instruct the SNMP Collector to take the data gathered during a specified collection interval, perform some mathematical operation on the data, and output the result as a performance metric. For non-snmp network resources, a Technology Pack provides Bulk collection formulas. A Bulk collection formula, unlike an SNMP collection formula, has no executable instructions. A Bulk collection formula consists of a metric name that is mapped by the Bulk Adaptor Design File to a statistic that resides in the input file generated by a network resource. Either type of collection formula outputs a metric and corresponding unique metric identifier (MID) that are passed along the DataChannel to the Complex Metric Engine for processing. How is the Data Processed and Loaded into the Database? The Complex Metric Engine (CME) is a component in the DataChannel that performs calculations on data gathered by the SNMP or Bulk collectors deployed in a network. These calculations include the following: Pre-defined formulas that are provided by a Technology Pack User-defined formulas created using the CME Formula API Time aggregations for sub-elements In addition to performing calculations on the data stream in the DataChannel, the CME also buffers and sorts metric records according to their RIDs and MIDs to optimize how the data and metrics are stored in the database. 2 Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X

Chapter 1: Introduction CME Operation The CME is designed to work with data that is gathered over the space of one hour. Within that hour, there are several distinct phases that characterize the operation of the CME: Loading Phase Building Phase Processing Phase Output Phase Loading Phase During the beginning of each hour, the CME creates a new network configuration model based on the inventory structure that exists in the database at that time. This model is used as a snapshot of the network environment and serves as the basis for all metric processing for the entire duration of the hour. At the end of the hour, the CME polls the database for any changes that have been made to the inventory and creates a new network configuration model for the next hour. As the CME reloads its configuration hourly, any metrics produced by sub-elements following the last polling period are rejected by the CME until the beginning of the next hour. Building Phase Once the current configuration model has been built, the CME creates a table of sub-elements and metrics that are expected for the current hour. The CME uses the RIDs and MIDs to build the table and determine which metrics should be arriving from the collectors. The table also specifies how resources are related, and determines if there are any CME formulas that must be applied to a sub-element s metrics once the data is gathered. Processing Phase Whenever new data arrives at the CME, it is evaluated and stored in the appropriate table location, along with any Resource Aggregation information. Once the input and processing dependencies for a metric in the table have been met, the CME processes the metrics and stores the data until the end of the hour. Output Phase At the end of the current hour, the CME outputs everything in memory to the Hourly and Daily Loaders. The data sent to the database loaders includes the sorted data for the current hour, and resource and group aggregations for each of the processing periods up to the current time. The Hourly Loader computes group and resource aggregations, while the Daily Loader creates metric statistics and inserts the data into the database. How is the Data Reported? The data collected, processed, and stored in the database by Netcool/Proviso is organized and output for customers using reporter sets that are designed by developers and Professional Services personnel for a specific Technology Pack. Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 3

Chapter 1: Introduction A Technology Pack reporter set is a related group of reports that provide performance information on a specific set of devices or resources that exist in a network. Each report consists of a series of queries that retrieve related sub-elements and their corresponding metrics from the database using the RIDs and MIDs assigned during the inventory and collection processes. The retrieved results are then organized within the report and are displayed on a web portal in the form of tables, graphs, and charts. A Technology Pack provides a variety of reports and charts, including: Resource Summary Reports (RSTs) (sometimes referred to as Resource Summary Tables) aggregate data across time for an individual sub-element and define the statistics that are relevant for a measure of its network performance. Group Summary Reports (GSTs) (sometimes referred to as Group Summary Tables) aggregate data across both time and sub-elements, and define the statistics that are relevant for a measure of network performance for a group of resources. Detail Charts (DCs) display raw data for a metric that has been aggregated for an individual sub-element over a particular period of time. Dashboards display a series of abbreviated tables and charts that provide an overall summary of the metrics collected for the target network resource supported by the Technology Pack. Timeseries charts present time series information, where the x axis is time and the y axis is the data value. TopN reports list the N highest values during a specified time range for a specific metric. Resource Distribution charts (often referred to as pie charts) show the distribution of resources across specific ranges. Typically, a legend for the Resource Distribution chart appears in the report. Resource Over Threshold Tables (RTTs) display a list of resources that have violated their threshold for a specific metric. Typically, users navigate to an RTT from a Group Summary Table (GST), using the threshold overflow cell navigation link. Ratio charts show the relationship of a single metric among different resources or a single resource among different metrics. 4 Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X

Chapter 2: Supported Reports This chapter discusses the following topics: Topic Page Overview 5 Reporter Sets 5 Overview The NetFlow IPFIX Technology Pack supplies a set of reports suitable for displaying information about the devices and activity associated with the NetFlow IPFIX environment. Reports contain metrics that are generated by the formulas that this technology pack provides. Metric names are the same as the names of the formulas that generate them. For information about a metric that is listed for a particular report, see the description of the associated formula in the collection formula chapter of this guide. This chapter includes information to help you navigate to a particular report on the DataView portal. This navigation path is the same as the path where the report has been deployed through the DataMart Resource Editor. Note, however, that some reports are not explicitly deployed on the portal navigation path. You can display such a report by "drilling down" to it from other reports. For information about understanding report types, creating reports, configuring reports, viewing and working with reports, and deploying reports, see the Netcool/Proviso DataView User s Guide. This Technology Pack User s Guide assumes an understanding of the report-related topics discussed in the Netcool/Proviso DataView User s Guide. Reporter Sets Reporter Set Tree This technology pack provides the reporter sets listed below. The list presents the reporter sets as they appear in the DataView Navigator tree structure: AP Cisco NetFlow Pack Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 5

Chapter 2: Supported Reports Reports This technology pack provides the following reports: Throughput Summary Group Throughput Summary Resource TopN ToS Summary Group Traffic Summary Group Traffic Summary Resource The reports in this technology pack are described on the following pages. 6 Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X

Chapter 2: Supported Reports Throughput Summary Group This group summary table displays data for throughput for sub-elements, aggregated across time and subelements: bytes in and out, packets in and out, and total bytes and packets. Reporter Set AP Cisco NetFlow Pack Tables and Charts Tables: Charts: Group Summary Table (1 of 2 implemented) Group Time Series Chart (2 of 2 implemented) Metrics Used in Report Bytes (throughput) Bytes In (throughput) Bytes Out (throughput) Packets (throughput) Packets In (throughput) Packets Out (throughput) Navigation Path Navigation path on the DataView portal: NOC Reporting > Cisco NetFlow > AS Matrix NOC Reporting > Cisco NetFlow > Network Applications NOC Reporting > Cisco NetFlow > Network Matrix NOC Reporting > Cisco NetFlow > Network to Host NOC Reporting > Cisco NetFlow > Networks NOC Reporting > Cisco NetFlow > Network ToS NOC Reporting > Cisco NetFlow > ToS Network NOC Reporting > Cisco NetFlow > Host to Network Drills Down To Throughput Summary Group Throughput Summary Resource Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 7

Chapter 2: Supported Reports Drilled Down From Throughput Summary Group 8 Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X

Chapter 2: Supported Reports Throughput Summary Resource This resource summary table displays aggregated data for throughput for sub-elements: bytes in and out, packets in and out, and total bytes and packets. Reporter Set AP Cisco NetFlow Pack Tables and Charts Charts: GroupTimeSeries (6 implemented) Metrics Used in Report Bytes (throughput) Bytes In (throughput) Bytes Out (throughput) Packets (throughput) Packets In (throughput) Packets Out (throughput) Navigation Path This report is not deployed on the portal navigation path during the initial configuration of the technology pack. To display this report, drill down to it from another report or deploy it with the DataMart Resource Editor. Drills Down To Drilled Down From Throughput Summary Group Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 9

Chapter 2: Supported Reports TopN ToS Summary Group This report summarizes the N highest values for total bytes and packets during a specified time range. Reporter Set AP Cisco NetFlow Pack Tables and Charts Tables: Charts: TopN (2 of 9 implemented) TopN (2 of 9 implemented) Metrics Used in Report Bytes Packets Navigation Path Navigation path on the DataView portal: NOC Reporting > Cisco NetFlow > ToS Network NOC Reporting > Cisco NetFlow > Network ToS Drills Down To TopN ToS Summary Group Traffic Summary Resource Drilled Down From TopN ToS Summary Group 10 Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X

Chapter 2: Supported Reports Traffic Summary Group This group summary table displays aggregated traffic data: Bytes in the inbound and outbound directions, and total bytes Packets in the inbound and outbound directions, and total packets Reporter Set AP Cisco NetFlow Pack Tables and Charts Tables: Charts: Group Summary Table (1 of 2 implemented) Group Time Series Chart (2 of 2 implemented) Metrics Used in Report Bytes In Bytes Out Bytes Packets In Packets Out Packets Navigation Path Navigation path on the DataView portal: NOC Reporting > Cisco NetFlow > Networks NOC Reporting > Cisco NetFlow > AS Matrix NOC Reporting > Cisco NetFlow > Network Applications NOC Reporting > Cisco NetFlow > Network Matrix NOC Reporting > Cisco NetFlow > Network to Host NOC Reporting > Cisco NetFlow > Network ToS NOC Reporting > Cisco NetFlow > ToS Network NOC Reporting > Cisco NetFlow > Host to Network Drills Down To Traffic Summary Group Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 11

Chapter 2: Supported Reports Traffic Summary Resource Drilled Down From Traffic Summary Group 12 Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X

Chapter 2: Supported Reports Traffic Summary Resource This resource summary table displays aggregated traffic data for sub-elements, as a time series chart: Bytes in the inbound and outbound directions, and total bytes Packets in the inbound and outbound directions, and total packets Reporter Set AP Cisco NetFlow Pack Tables and Charts Charts: GroupTimeSeries (6 implemented) Metrics Used in Report Bytes In Bytes Out Bytes Packets In Packets Out Packets Navigation Path This report is not deployed on the portal navigation path during the initial configuration of the technology pack. To display this report, drill down to it from another report or deploy it with the DataMart Resource Editor. Drills Down To Drilled Down From TopN ToS Summary Group Traffic Summary Group Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 13

Chapter 2: Supported Reports NOTES 14 Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X

Chapter 3: Devices and Services This chapter discusses the following topics: Topic Page Overview 15 Summary of Device Technology 15 Technology Pack Overview 16 Components and Data Flow 16 Configuration File 17 Input Files 17 Overview This chapter provides a summary of NetFlow IPFIX and how this technology pack uses NetFlow datagrams to monitor and provide performance reports about NetFlow-enabled routers. Note: The NetFlow IPFIX Technology Pack operates with routers running NetFlow, versions 1, 5 through 9, and IETF IPFIX. Summary of Device Technology NetFlow IPFIX is a proprietary network accounting protocol. Cisco routers and compatible devices export details of routed packets in a stream of UDP/TCP/SCTP datagrams to a NetFlow collector. These datagrams contain detailed data that can be used to provide a comprehensive understanding of network behavior. NetFlow was developed by Cisco as an agent that runs on its routers and measures traffic flows traversing a router s interfaces. The flow information is then sent in NetFlow records, carried in UDP datagrams, to a collector to process and make the information available to users. The set of information collected and the format of the records has evolved over time and been adopted by other vendors. The IP Flow Informaton exchange (IETF IPFIX) working group has adopted it as the standard for carrying traffic flow information. A flow record includes the following information: source and destination IP address, source and destination subnet, source and destination port, AS of previous hop and AS of destination address, IP header protocol field value, ToS (DSCP, IP Prec), a timestamp, and the number of packets and octets. It is also extendable and can contain the MPLS Label stack, and more. Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 15

Chapter 3: Devices and Services Technology Pack Overview This technology pack supports NetFlow and IPFIX flow measurement technology. It obtains NetFlow datagrams directly from NetFlow-enabled routers and uses this information to provide performance reports about network- and application-layer IP traffic on these devices. Components and Data Flow The major technology pack components are: Aurora Netflow Collector the technology pack adapter that captures NetFlow datagrams and exports this information to CSV files. The Aurora Netflow Collector captures NetFlow datagrams, performs data enrichment, aggregations, and publishes the results as CSV files. CiscoNetFlowAdaptor.js the technology pack s UBA design file that obtains the CSV files and imports the data into Netcool/Proviso. Aurora Netflow Collector The Aurora NetFlow system has been extended to interoperate with Netcool/Proviso. The key issues for using Aurora with Proviso are: Routers can be configured to send NetFlow/IPFIX information over UDP, TCP or SCTP directly to the Aurora server. The receive port can be configured (the default is UDP/2055). Router interfaces can be explicitly ignored, for instance to avoid duplicate flow reporting. The size of the receive buffer can be configured (the default is50mb, i.e., a burst of 1 M flows can be accommodated). The Aurora release for Proviso is configured by default to write a CSV file for every full hour. The file is written once after no more NetFlow information is expected to affect this hour. The database is configured such that daily, monthly and yearly information is not maintained. If a flow spreads over two hours, its volume will be correctly split between the two hours. Aurora can be configured with user-defined aggregations. An aggregation or topic is called aspect in Aurora. The default configuration for Proviso contains pre-configured user-defined aspects. For more information about aspects, see Appendix D, Aurora Netflow Collector Installation and Configuration. Aurora for Proviso is written in C and compiles under Linux, Solaris and AIX. The aurorad executable is controlled by means of the shell script aurora. Aurora processes run under system user pvuser in group staff (on Solaris) and user aurora in group aurora on Linux. The configuration can be modified by means of the aurora script and by editing the configuration files directly. The aurora script and configuration files are described in more detail in Appendix D, Aurora Netflow Collector Installation and Configuration. An accurate system time is important for running Aurora. The system time must be identical to the system time of the exporting routers. The following provides a high-level description of the data flow involved: 1. At regular intervals, NetFlow-enabled routers export datagrams to the Aurora engine. 2. The Aurora engine aggregates data according to the site configuration and creates CSV files in the data directory. 3. The CiscoNetFlowAdaptor.js adaptor file polls the data directory on a regular basis and processes the CSV files using an inline inventory. 16 Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X

Chapter 3: Devices and Services The NetFlow datagrams come in a variety of versions. Version 9 is the latest version and is the basis for the IETF standard called IPFix. IPFix, Version 5 is the most common today and contains the following fields: Source IP address Destination IP address Source TCP/UDP port Destination TCP/UDP port IP protocol Type of Service (Tos) byte Input physical interface index Output physical interface index TCP flags (cumulative OR) Next hop router IP Packet count Byte count Start of flow timestamp End of flow timestamp Source AS number Destination AS number Source subnet mask Destination subnet mask The first seven fields are used as the primary key to identify unique flows. Configuration File Information about this technology pack must be added to the DataChannel s configuration file (dc.cfg). To facilitate this process, a template configuration file is included with this pack when it is installed. The template file is named cisco_netflow_sample_dc.cfg and contains pack-specific parameters that must be added to dc.cfg. Information about using this file is located in Appendix A, Configuration and Appendix C, Template File Reference (Pre-443 Only). Input Files The Aurora Netflow Collector performs data enrichment, aggregates the data according to a mapping file, and creates CSV files in its data directory. The CSV files are named using the following syntax: The exact syntax is: <yyyy>-<mm>-<dd>_<hh>-<mm>.csv The structure of the CSV files are defined in the /opt/aurora/var/sites/proviso/etc/report_site.ash file. The following is a sample record. Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 17

Chapter 3: Devices and Services site aspect select NetHost octets $keys$ = site aspect get keys loop i 1 1 @@keys@@ { site aspect select NetHost octets $bytes_sent$ = site aspect printf "%tva_counter:tot_sent%" @@keys:$i$@@ $bytes_recv$ = site aspect printf "%tva_counter:tot_recv%" @@keys:$i$@@ site aspect select NetHost packets $packets_sent$ = site aspect printf "%tva_counter:tot_sent%" @@keys:$i$@@ $packets_recv$ = site aspect printf "%tva_counter:tot_recv%" @@keys:$i$@@ site aspect printf "Source=Aurora,Site=proviso,Topic=NetHost,Timestamp=$date$,SE,ip_router =%flow:exporter_ip%,domain_src=%flow:domain_src#name%,ip_dst=%flow:ip_dst# name%,application=%flow:application#name%,ue,packetsout=$packets_sent$, BytesOut=$bytes_sent$,PacketsIn=$packets_recv$,BytesIn=$bytes_recv$\n" @@keys:$i$@@ } site aspect select HostNet octets $keys$ = site aspect get keys loop i 1 1 @@keys@@ { site aspect select HostNet octets $bytes_sent$ = site aspect printf "%tva_counter:tot_sent%" @@keys:$i$@@ $bytes_recv$ = site aspect printf "%tva_counter:tot_recv%" @@keys:$i$@@ site aspect select HostNet packets $packets_sent$ = site aspect printf "%tva_counter:tot_sent%" @@keys:$i$@@ $packets_recv$ = site aspect printf "%tva_counter:tot_recv%" @@keys:$i$@@ site aspect printf "Source=Aurora,Site=proviso,Topic=HostNet,Timestamp=$date$,SE,ip_router =%flow:exporter_ip%,ip_src=%flow:ip_src#name%,domain_dst=%flow:domain_dst# name%,application=%flow:application#name%,ue,packetsout=$packets_sent$, BytesOut=$bytes_sent$,PacketsIn=$packets_recv$,BytesIn=$bytes_recv$\n" @@keys:$i$@@ } SE fields correspond to Proviso Sub-Element properties. UE fields correspond to Proviso metrics values. Since a fixed field structure is not used, each record is read in as a single field. Javascript string processing functions are used to process the record into its constituent parts. 18 Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X

Chapter 4: Element and Sub-Element Properties This chapter discusses the following topics: Topic Page Overview 19 NetFlow IPFIX Device Element Properties 19 NetFlow IPFIX Device Sub-Element Properties 19 Overview A Netcool/Proviso property is an attribute or characteristic of an element or sub-element. Typically, a Netcool/Proviso Technology Pack uses an inventory process to collect information generated by the devices, interfaces, and services operating in the technology environment it supports. A technology pack uses Netcool/Proviso properties for some or all of the following purposes: To organize information in reports To display values in reports To construct names such as sub-element names, sub-element instance names, and sub-element labels The Netcool/Proviso properties associated with sub-elements appear in the Properties list (Sub-Element view) of the Netcool/Proviso DataMart Resource Editor. See the Netcool/Proviso DataMart Configuration Guide for more information on the Resource Editor. NetFlow IPFIX Device Element Properties The NetFlow IPFIX Technology Pack creates an element for each source router. The element name is the router IP address. NetFlow IPFIX Device Sub-Element Properties The following pages describe the sub-element properties used in this technology pack. Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 19

Chapter 4: Element and Sub-Element Properties Element.STATE Determines whether the element is active, and controls the collection for all sub-elements attached to the element. The value must be on in order for collection and discovery to occur. Captured in Discovery Formulas Used in CME Formulas Used in Reports Used in Grouping Rules NOC Reporting Sub-Element Collect Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 20

Chapter 4: Element and Sub-Element Properties NF_Application The layer-4 application name. Captured in Discovery Formulas Used in CME Formulas Used in Reports Used in Grouping Rules NOC Reporting Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 21

Chapter 4: Element and Sub-Element Properties NF_DestIPAddress The destination IP address of the flow. Captured in Discovery Formulas Used in CME Formulas Used in Reports Used in Grouping Rules NOC Reporting Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 22

Chapter 4: Element and Sub-Element Properties NF_DestIPAsNumber The destination IP as an integer. Captured in Discovery Formulas Used in CME Formulas Used in Reports Used in Grouping Rules Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 23

Chapter 4: Element and Sub-Element Properties NF_DestMask The destination routes mask bits. Captured in Discovery Formulas Used in CME Formulas Used in Reports Used in Grouping Rules Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 24

Chapter 4: Element and Sub-Element Properties NF_DestNet The destination mask applied to the destination IP. Captured in Discovery Formulas Used in CME Formulas Used in Reports Used in Grouping Rules NOC Reporting Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 25

Chapter 4: Element and Sub-Element Properties NF_DestPort The destination port of the flow. Captured in Discovery Formulas Used in CME Formulas Used in Reports Used in Grouping Rules Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 26

Chapter 4: Element and Sub-Element Properties NF_DstAsNum This property is used to store the Destination ASNumber. Captured in Discovery Formulas Used in CME Formulas Used in Reports Used in Grouping Rules NOC Reporting Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 27

Chapter 4: Element and Sub-Element Properties NF_InputIFIndex The input interface index number. Captured in Discovery Formulas Used in CME Formulas Used in Reports Used in Grouping Rules Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 28

Chapter 4: Element and Sub-Element Properties NF_NetworkName The network name. Captured in Discovery Formulas Used in CME Formulas Used in Reports Used in Grouping Rules NOC Reporting Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 29

Chapter 4: Element and Sub-Element Properties NF_NextHop The next hop routers IP address. Captured in Discovery Formulas Used in CME Formulas Used in Reports Used in Grouping Rules Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 30

Chapter 4: Element and Sub-Element Properties NF_OutputIFIndex The output interface index number. Captured in Discovery Formulas Used in CME Formulas Used in Reports Used in Grouping Rules Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 31

Chapter 4: Element and Sub-Element Properties NF_Protocol The protocol name. Captured in Discovery Formulas Used in CME Formulas Used in Reports Used in Grouping Rules NOC Reporting Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 32

Chapter 4: Element and Sub-Element Properties NF_Router The IP address of the router that the NetFlow was exported from. Captured in Discovery Formulas Used in CME Formulas Used in Reports Used in Grouping Rules Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 33

Chapter 4: Element and Sub-Element Properties NF_Site The Aurora site profile that is being used. Captured in Discovery Formulas Used in CME Formulas Used in Reports Used in Grouping Rules Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 34

Chapter 4: Element and Sub-Element Properties NF_SourceIPAddress The source IP address of the flow. Captured in Discovery Formulas Used in CME Formulas Used in Reports Used in Grouping Rules NOC Reporting Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 35

Chapter 4: Element and Sub-Element Properties NF_SourceIPAsNumber The source IP as an integer. Captured in Discovery Formulas Used in CME Formulas Used in Reports Used in Grouping Rules Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 36

Chapter 4: Element and Sub-Element Properties NF_SourceMask The source routes mask bits. Captured in Discovery Formulas Used in CME Formulas Used in Reports Used in Grouping Rules Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 37

Chapter 4: Element and Sub-Element Properties NF_SourceNet The source mask applied to the source IP. Captured in Discovery Formulas Used in CME Formulas Used in Reports Used in Grouping Rules NOC Reporting Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 38

Chapter 4: Element and Sub-Element Properties NF_SourcePort The source port of the flow. Captured in Discovery Formulas Used in CME Formulas Used in Reports Used in Grouping Rules Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 39

Chapter 4: Element and Sub-Element Properties NF_SrcAsNum This property is used to store the Source ASNumber. Captured in Discovery Formulas Used in CME Formulas Used in Reports Used in Grouping Rules NOC Reporting Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 40

Chapter 4: Element and Sub-Element Properties NF_TCPFlags The cumulative OR of the TCP flags. Captured in Discovery Formulas Used in CME Formulas Used in Reports Used in Grouping Rules Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 41

Chapter 4: Element and Sub-Element Properties NF_Topic The name of the aggregation that the SMDR describes. Captured in Discovery Formulas Used in CME Formulas Used in Reports Used in Grouping Rules NOC Reporting Sub-Element Collect Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 42

Chapter 4: Element and Sub-Element Properties NF_Tos The value of the ToS byte. Captured in Discovery Formulas Used in CME Formulas Used in Reports Used in Grouping Rules NOC Reporting Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 43

Chapter 4: Element and Sub-Element Properties STATE Determines whether the sub-element is active, and controls the collection for one sub-element. The value must be on in order for collection and discovery to occur. Captured in Discovery Formulas Used in CME Formulas Used in Reports Used in Grouping Rules NOC Reporting Sub-Element Collect Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 44

Chapter 5: Sub-Element Grouping Rules This chapter discusses the following topics: Topic Page Overview 45 NOC Reporting Grouping Rules 46 Sub-Element Collect Grouping Rules 49 Overview Typically, a Netcool/Proviso Technology Pack defines sub-element grouping rules. Grouping rules organize and filter networking data into a structure that makes it easier to collect data on thousands or millions of resources. Sub-element grouping rules organize data in tree structures. Each folder (branch) in the tree is associated with a rule or condition. If a sub-element property satisfies the rule or condition associated with a folder in the grouping tree, the sub-element is placed in the folder. The sub-element is then tested against the rule or condition in the next folder below. If the sub-element passes that test, it is tested against the rule or condition in the next folder, and so on. The NetFlow IPFIX Technology Pack uses some of its Netcool/Proviso properties to define sub-element grouping rules. Grouping rule names appear in the Name field (Rule Sub-Element view) of the Netcool/Proviso DataMart Rule Editor. For information on how to use the Netcool/Proviso DataMart Rule Editor, see the Netcool/Proviso DataMart Configuration Guide. The Rule Editor contains two grouping rule trees the NOC reporting tree and the sub-element collect tree. The following sections describe the filtering rules and conditions in these trees. Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 45

Chapter 5: Sub-Element Grouping Rules NOC Reporting Grouping Rules The NOC reporting tree provides the framework that allows users to navigate to reports. The following illustration is a portion of the NOC Reporting tree as it appears in the DataMart Rule Editor. The shaded branches represent the NetFlow IPFIX portion of the tree: The branches are described as follows: 46 Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X

Chapter 5: Sub-Element Grouping Rules Branch Name Cisco NetFlow NetApp %(NF_NetworkName) %(NF_Protocol) %(NF_Application) Networks %(NF_NetworkName) AS Matrix Source AS%(NF_SrcAsNum) Destination AS%(NF_DstAsNum) Network Matrix Source %(NF_SourceNet) Destination %(NF_DestNet) %(NF_Application) Type: Static. Purpose: Organization only (contains all NetFlow IPFIX sub-elements). %(NF_Topic) IS NOT NULL Collects any resources that have the NF_Topic property. Type: Static Traffic summary group. %(NF_Topic) = 'NetApp' Collects resources whose NF_Topic property is equal to NetApp. Type: Rule. Purpose: Groups NetApp sub-elements according to name. Type: Rule. Purpose: Groups NetApp sub-elements according to protocol. Type: Rule. Purpose: Groups NetApp sub-elements according to application. Type: Static. Purpose: Filters by condition: %(NF_Topic) = 'Network' Uses the NF_Topic property to group Network sub-elements. Type: Rule. Purpose: Groups Network sub-elements according to name. Type: Static. Purpose: Filters by condition: %(NF_Topic) = 'AsNum' Uses the NF_Topic property to group AsNum sub-elements. Type: Rule. Purpose: Groups collected AsNum sub-elements according to originating source. Type: Rule. Purpose: Groups collected AsNum sub-elements according to destination source. Type: static %(NF_Topic) = 'NetMatrix' Uses the NF_Topic property to group NetMatrix sub-elements. Type: rule Purpose: Groups collected NetMatrix sub-elements according to originating source. Type: rule Purpose: Groups collected NetMatrix sub-elements according to destination source. Type: Rule. Purpose: Groups NetMatrix sub-elements according to application. Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 47

Chapter 5: Sub-Element Grouping Rules Branch Name Network to Host Source %(NF_SourceNet) Destination %(NF_DestIPAddress) %(NF_Application) Host to Network Source %(NF_SourceIPAddress) Destination %(NF_DestNet) %(NF_Application) Network ToS %(NF_NetworkName) %(NF_ToS) ToS Network %(NF_ToS) %(NF_NetworkName) Type: Static Traffic summary group. %(NF_Topic) = 'NetHost' Collects resources whose NF_Topic property is equal to NetHost. Type: rule Purpose: Groups collected NetHost sub-elements according to originating source. Type: rule Purpose: Groups collected NetHost sub-elements according to destination source. Type: Rule. Purpose: Groups collected NetHost sub-elements according to application. Type: Static Traffic summary group. %(NF_Topic) = 'HostNet' Collects resources whose NF_Topic property is equal to HostNet. Type: rule Purpose: Groups collected HostNet sub-elements according to originating source. Type: rule Purpose: Groups collected HostNet sub-elements according to destination source. Type: Rule. Purpose: Groups collected HostNet sub-elements according to application. Type: Static. Purpose: Filters by condition: %(NF_Topic) = 'NetToS' Uses the NF_Topic property to group NetToS sub-elements. Type: Rule. Purpose: Groups NetToS sub-elements according to name. Type: Rule. Purpose: Groups NetToS sub-elements according to protocol. Type: Static. Purpose: Filters by condition: %(NF_Topic) = 'NetToS' Uses the NF_Topic property to group NetToS sub-elements. Type: Rule. Purpose: Groups NetToS sub-elements according to protocol. Type: Rule. Purpose: Groups NetToS sub-elements according to name. 48 Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X

Chapter 5: Sub-Element Grouping Rules Sub-Element Collect Grouping Rules The sub-element collection tree organizes the requests that collect metrics from sub-elements. The following illustration is a portion of the Sub-Element Collect tree as it appears in the DataMart Rule Editor. The shaded branches represent the NetFlow IPFIX portion of the tree: The branches are described as follows: Branch Name Cisco NetFlow Type: Static. Purpose: Organization only (contains all Cisco NetFlow sub-elements). %(NF_Topic) IS NOT NULL Collects any resources that have the NF_Topic property. Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 49

Chapter 5: Sub-Element Grouping Rules NOTES 50 Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X

Chapter 6: Defined Resources This chapter discusses the following topics: Topic Page Overview 51 NetFlow IPFIX Technology Pack Elements 51 NetFlow IPFIX Technology Pack Sub-Elements 51 Overview A Netcool/Proviso resource is a network element or sub-element, such as a router or a hub. Typically, an IBM Technology Pack defines a set of Netcool/Proviso elements, sub-elements, and properties that map to specific devices and services operating in a network. These resources allow IBM support engineers to: Configure (using the Netcool/Proviso DataMart Request Editor) data collection requests for the subelements associated with each Technology Pack View (using the Netcool/Proviso DataMart Resource Editor) sub-elements and sub-element groups associated with each Technology Pack NetFlow IPFIX Technology Pack Elements This technology pack creates an element for each monitored router. The element name is the router s IP address. This element has no properties. NetFlow IPFIX Technology Pack Sub-Elements The NetFlow IPFIX Technology Pack provides the following Netcool/Proviso resources for the devices, services, and interfaces that the NetFlow IPFIX device manages: Networks NetApp ASNum NetMatrix NetHost (not enabled by default) HostNet (not enabled by default) Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 51

Chapter 6: Defined Resources NetToS A subelement is created with a unique set of SE fields. Each aggregation (topic) has a fixed set of fields so each topic corresponds to a type of subelement. The general naming convention is as follows: Topic:<topic>;<FieldName1>:<FieldValue1>; <FieldNameN>:<FieldValueN> The name and label are both given the same value. Tables of Sub-Element Types The tables in this section describe the kinds of NetFlow IPFIX sub-elements that this technology pack manages. Note the following about the tables: The Naming Structure row defines how sub-element names, sub-element labels, and sub-element instance names are constructed. The following typeface conventions are used: NetFlow IPFIX Technology Pack property names are presented in monospace type (for example, DSPCard) References to element names, instance names, and other variables are presented in italic type (for example, ElementName_<InstanceName>. The Properties row lists the NetFlow IPFIX Technology Pack properties associated with the particular subelement type. For descriptions of the properties, see the chapter on element and sub-element properties. 52 Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X

Chapter 6: Defined Resources Networks This sub-element provides the following information: Name The name consists of the following format: <ip>_topic:<topic>;networkname;<network name>;router:<router> <ip> the router IP address Topic a static string <topic> the topic name provided by the NF_Topic property NetworkName a static string <network name> the network name provided by the NF_NetworkName property Router a static string <router> the router provided by the NF_Router property Example: 173.23.7.123_Topic:Network;NetworkName:broadcast;Router:173.23.7. 123 Topic:Network;Network:Head Office;Router:192.168.0.1 Family Instance Label Cisco_Netflow_Network The instance name is the same as the sub-element name minus the leading IP address. Example: Topic:Network;NetworkName:broadcast;Router:173.23.7.123 The label name is the same as the instance name. This sub-element uses the following properties: Properties NF_Topic NF_Router NF_NetworkName Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 53

Chapter 6: Defined Resources NetApp This sub-element provides the following information: The name consists of the following format: <ip>_topic:netapp;application:<app>;networkname:<network name>;protocol:<protocol>; Router:<router>;Tos:<tos> Name <ip> the element name (the IP address) Topic a static string NetApp the topic name provided by the NF_Topic property; for applications, this value is always NetApp. Application a static string <app> the application name provided by the NF_Application property NetworkName a static string <network name> the network name provided by the NF_NetworkName property Protocol a static string <protocol> the protocol provided by the NF_Protocol property Router a static string <router> the router provided by the NF_Router property Tos a static string <tos> the type of service aggregation provided by the NF_Tos property Example: 172.8.5.7_Topic:NetApp;Application:netbillkeyrep;NetworkName:broad cast;protocol:udp;router:172.8.5.7;tos:0 Topic:Network;Application:HTTP;Network:Head Office;Protocol:TCP;Router:192.168.0.1;ToS:1 Family Cisco_Netflow_NetApp The instance name is the same as the sub-element name minus the leading IP address. Instance Label Example: Topic:NetApp;Application:netbillkeyrep;NetworkName:broadcast;Proto col:udp;router:172.8.5.7;tos:0 The label name is the same as the instance name. This sub-element uses the following properties: Properties NF_Topic NF_Router NF_Protocol NF_Application NF_Tos NF_NetworkName 54 Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X

Chapter 6: Defined Resources ASNum This sub-element provides the following information: Name The name consists of the following format: <ip>_topic:<topic>;dstasnum:<dstasnum>;router:<router>;nf_srcasnum:<srcasnum> <ip> the router IP address Topic a static string <topic> the topic name provided by the NF_Topic property; for applications, this value is always AsNum. DstAsNum a static string <dstasnum> the destination AS number provided by the NF_DstAsNum property Router a static string <router> the router provided by the NF_Router property SrcAsNum a static string <srcasnum> the source AS number provided by the NF_SrcAsNum property Example: 173.23.7.123_Topic:AsNum;Router:192.168.0.1;DstAsNum:4003;SrcAsNu m:4000 Family Instance Label Cisco_Netflow_AsNum The instance name is the same as the sub-element name minus the leading IP address. Example: Topic:AsNum;DstAsNum:4003;Router:172.8.5.7;SrcAsNum:4000 The label name is the same as the instance name. This sub-element uses the following properties: Properties NF_Topic NF_Router NF_NetworkName Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 55

Chapter 6: Defined Resources NetMatrix This sub-element provides the following information: Name The name consists of the following format: <ip>_topic:<topic>;dstasnum:<dstasnum>;router:<router>;nf_srcasnum:<srcasnum> <ip> the router IP address Topic a static string <topic> the topic name provided by the NF_Topic property; for applications, this value is always AsNum. DestinationNetwork a static string <dstasnum> the destination AS number provided by the NF_DstAsNum property Router a static string <router> the router provided by the NF_Router property SourceNetwork a static string <srcasnum> the source AS number provided by the NF_SrcAsNum property Application a static string Example: Topic:NetMatrix;Router:192.168.0.1;SourceNetwork:Perth Head Office;DestinationNetwork:Lowell Head Office;Application:SSH Family Cisco_Netflow_AsNum The instance name is the same as the sub-element name minus the leading IP address. Instance Label Example: Topic:NetMatrix;Router:192.168.0.1;SourceNetwork:Perth Head Office;DestinationNetwork:Lowell Head Office;Application:SSH The label name is the same as the instance name. This sub-element uses the following properties: Properties NF_Topic NF_Router NF_NetworkName 56 Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X

Chapter 6: Defined Resources NetHost For reasons of load balancing, this is not enabled by default. For more information about load balancing, see Scalability on page 136. This sub-element provides the following information: Name The name consists of the following format: <ip>_topic:<topic>;dstasnum:<dstasnum>;router:<router>;nf_srcasnum:<srcasnum> <ip> the router IP address Topic a static string <topic> the topic name provided by the NF_Topic property; for applications, this value is always AsNum. DestinationHost a static string <dstasnum> the destination AS number provided by the NF_DstAsNum property Router a static string <router> the router provided by the NF_Router property SourceNetwork a static string <srcasnum> the source AS number provided by the NF_SrcAsNum property Application a static string Example: Topic:NetMatrix;Router:192.168.0.1;SourceNetwork:Perth Head Office;DestinationNetwork:Lowell Head Office;Application:SSH Family Cisco_Netflow_AsNum The instance name is the same as the sub-element name minus the leading IP address. Instance Label Example: Topic:NetHost;Router:192.168.0.1;SourceNetwork:New York IT Department;DestinationHost:10.150.159.5;Application:Remote Desktop Protocol The label name is the same as the instance name. This sub-element uses the following properties: Properties NF_Topic NF_Router NF_NetworkName Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 57

Chapter 6: Defined Resources HostNet For reasons of load balancing, this is not enabled by default. For more information about load balancing, see Scalability on page 136. This sub-element provides the following information: Name The name consists of the following format: <ip>_topic:<topic>;dstasnum:<dstasnum>;router:<router>;nf_srcasnum:<srcasnum> <ip> the router IP address Topic a static string <topic> the topic name provided by the NF_Topic property; for applications, this value is always AsNum. DestinationHost a static string <dstasnum> the destination AS number provided by the NF_DstAsNum property Router a static string <router> the router provided by the NF_Router property SourceIP a static string <srcasnum> the source AS number provided by the NF_SrcAsNum property Application a static string Example: Topic:NetHost;Router:192.168.0.1;SourceNetwork:New York IT Department;DestinationHost:10.150.159.5;Application:Remote Desktop Protocol Family Cisco_Netflow_<topic> The instance name is the same as the sub-element name minus the leading IP address. Instance Label Example: Topic:NetHost;Router:192.168.0.1;SourceNetwork:New York IT Department;DestinationHost:10.150.159.5;Application:Remote Desktop Protocol The label name is the same as the instance name. This sub-element uses the following properties: Properties NF_Topic NF_Router NF_NetworkName 58 Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X

Chapter 6: Defined Resources NetToS This sub-element provides the following information: Name Family The name consists of the following format: <ip>_topic:<topic>;router:<router>;network:<network>;tos:<tos> <ip> the router IP address Topic a static string <topic> the topic name provided by the NF_Topic property; for applications, this value is always AsNum. Router a static string <router> the router provided by the NF_Router property Network a static string <network> the network or domain provided by the NF_NetworkName property ToS a static string <tos> the type of service provided by the NF_Tos property Example: Topic:NetHost;Router:192.168.0.1; Network:New York IT Department;ToS:best effort Cisco_Netflow_<topic> The instance name is the same as the sub-element name minus the leading IP address. Instance Label Example: Topic:NetHost;Router:192.168.0.1; Network:New York IT Department;ToS:best effort The label name is the same as the instance name. This sub-element uses the following properties: Properties NF_Topic NF_Router NF_NetworkName Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 59

Chapter 6: Defined Resources NOTES 60 Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X

Chapter 7: Bulk Collection Formulas This chapter discusses the following topics: Topic Page Overview 61 Data Collection 61 Formulas and Metrics 62 Formula Reference 62 Overview A Bulk collection formula, unlike an SNMP collection formula, has no executable instructions. However, the Bulk Collector requires database IDs for the value it returns after reading Bulk input files. Bulk collection formulas provide these unique database IDs. The Formula Table (FRML_DESC) must contain an ID for each metric the Bulk Collector might return. If the entry in the Formula Table does not exist, the Bulk Collector cannot report the value. Typically, a Bulk collection formula consists of a name that maps to a statistic that resides in a Bulk input file. Typically, the device or devices that the technology pack supports generate the statistics that reside in these Bulk input files. In many cases, the statistics reside in these Bulk input files as data records or data fields. Each Bulk collection formula name has an associated ID. It is the Bulk collection formula ID (along with the subelement ID and timestamp) that identify a specific location in the database where the statistic resides. In other words, the Bulk collection formulas do not perform any calculations, but merely serve as pointers to the actual statistics residing in the database. There are many formats associated with Bulk input files, for example CSV, XML, and binary. Typically, a technology pack provides a Bulk Adaptor Design File (implemented as a JavaScript file) that defines the format or formats of the Bulk input files for which it is responsible for processing. This Bulk Adaptor Design File processes both inventory and statistics from the same Bulk input file. More specifically, this Bulk Adaptor Design File provides a function that creates the Bulk collection formula names. Some technology packs might provide several Bulk Adaptor Design Files each of which handles a specific Bulk input file format. Data Collection This technology pack uses bulk collection to gather data about NetFlow IPFIX devices and services. With bulk collection, the Netcool/Proviso Bulk Collector gathers input files that contain non-snmp data generated by NetFlow IPFIX devices. This data is processed by the technology pack s Bulk Adaptor Design File, CiscoNetFlowAdaptor.js. Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 61

Chapter 7: Bulk Collection Formulas Formulas and Metrics After the network data is collected, Netcool/Proviso processes the data and generates the metrics that are stored in the DataMart database and used in DataView reports. This processing is performed by the formulas described in this chapter. A metric has the same name as the formula that generates it. Metrics are categorized according to the type of process used to calculate the metric, as follows: Import Data collected from bulk input files generated by a NetFlow IPFIX device and processed by the Bulk Adaptor Design File. In some cases, the design file maps a bulk metric to a single statistic in an input file. In other cases, the design file generates a bulk metric value through a calculation involving multiple input file statistics. Generic A metric whose database location is mapped to multiple formulas. This allows the formulas to store the metrics they generate against a single database ID, allowing the metrics to appear in a single DataView report. CME Metrics that are produced by calculations that the Netcool/Proviso Complex Metric Engine (CME) performs, using other metrics and sub-element properties as inputs. Note: Generic and CME formulas may not be included in this technology pack. Metrics may appear in DataView reports as raw data, or they may be further processed by the Complex Metric Engine for example, to produce data aggregations over time. To learn where the metrics generated by the formulas in this chapter are used, see the chapter on supported reports in this guide. This chapter is a reference of the formulas that the NetFlow IPFIX Technology Pack provides. The chapter lists formulas alphabetically. Formula Reference The following pages provide a reference of the bulk collection formulas that this technology pack provides. The reference pages have the following sections: Type. The source of data for the formula being described for example, IMPORT (collect).. The description of the formula. Syntax. Bulk formulas have no executable instructions. Typically, this section indicates that a bulk metric is mapped to this formula in the Netcool/Proviso database. Bulk metrics can be used in Netcool/Proviso DataView reports and in calculations of other metrics. Generic Database Alias. A database location where the bulk metric can be stored. Typically, generic metrics serve as repositories in the database for mixed data collected from a particular kind of sub-element for example, low- and high-capacity interfaces. Storing mixed data against a generic metric ID allows you to display the different kinds of data in a single report. Path. The path where the referenced bulk formula appears in the Netcool/Proviso database. You view the formula tree through the Formula Selector dialog of the Netcool/Proviso Formula Editor. To display this dialog, click File > Load in the Formula Editor. 62 Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X

Chapter 7: Bulk Collection Formulas Bytes (throughput) Type CME This collection formula represents the number of bytes per second throughput. Syntax ^(bytesin + bytesout) / 3600 Formula Input Input: bytesin Source: Bytes In (Formula) Input: bytesout Source: Bytes Out (Formula) Generic Database Alias Formula Editor Path AP > Specific > CME > Cisco > NetFlow Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 63

Chapter 7: Bulk Collection Formulas Bytes In (throughput) Type CME This collection formula represents the number of bytes per second of inbound throughput. Syntax ^bytesin / 3600 Formula Input Input: bytesin Source: Bytes In (Formula) Generic Database Alias Formula Editor Path AP > Specific > CME > Cisco > NetFlow 64 Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X

Chapter 7: Bulk Collection Formulas Bytes In Type Import This collection formula represents the volume of traffic, in bytes, in the inbound direction. Syntax #Bulk Metric Generic Database Alias Formula Editor Path AP > Specific > Bulk > Cisco > NetFlow Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 65

Chapter 7: Bulk Collection Formulas Bytes Out (throughput) Type CME This collection formula represents the number of bytes outbound per second of throughut. Syntax ^bytesout / 3600 Formula Input Input: bytesout Source: Bytes Out (Formula) Generic Database Alias Formula Editor Path AP > Specific > CME > Cisco > NetFlow 66 Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X

Chapter 7: Bulk Collection Formulas Bytes Out Type Import This collection formula represents the volume of traffic, in bytes, in the outbound direction. Syntax #Bulk Metric Generic Database Alias Formula Editor Path AP > Specific > Bulk > Cisco > NetFlow Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 67

Chapter 7: Bulk Collection Formulas Bytes Type Import This collection formula represents the total volume of traffic, in bytes. Syntax #Bulk Metric Generic Database Alias Formula Editor Path AP > Specific > Bulk > Cisco > NetFlow 68 Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X

Chapter 7: Bulk Collection Formulas BytesTotal Type CME This collection formula is created by CME Formula Editor, and represents the sum of BytesIn and BytesOut. Syntax a b bytesin isnil iftrue:[a:=0] iffalse:[a:=bytesin]. bytesout isnil iftrue:[b:=0] iffalse:[b:=bytesout]. ^(a+b) Formula Input Input: bytesin Source: Bytes In (Formula) Input: bytesout Source: Bytes Out (Formula) Generic Database Alias Bytes Formula Editor Path AP > Specific > CME > Cisco > NetFlow Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 69

Chapter 7: Bulk Collection Formulas Flows Type Import This collection formula represents the number of flows for a Netflow device. Syntax #Bulk Metric Generic Database Alias Formula Editor Path AP > Specific > Bulk > Cisco > NetFlow 70 Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X

Chapter 7: Bulk Collection Formulas Packets (throughput) Type CME This formula represents the number of packets per second of throughput for a Netflow device. Syntax ^(packetsin + packetsout) / 3600 Formula Input Input: packetsin Source: Packets In (Formula) Input: packetsout Source: Packets Out (Formula) Generic Database Alias Formula Editor Path AP > Specific > CME > Cisco > NetFlow Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 71

Chapter 7: Bulk Collection Formulas Packets In (throughput) Type CME This formula represents the number of packets inbound per second of throughput for a Netflow device. Syntax ^packetsin / 3600 Formula Input Input: packetsin Source: Packets In (Formula) Generic Database Alias Formula Editor Path AP > Specific > CME > Cisco > NetFlow 72 Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X

Chapter 7: Bulk Collection Formulas Packets In Type Import This formula represents the number of packets in the inbound direction for a Netflow device. Syntax #Bulk Metric Generic Database Alias Formula Editor Path AP > Specific > Bulk > Cisco > NetFlow Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 73

Chapter 7: Bulk Collection Formulas Packets Out (throughput) Type CME This formula represents the number of packets per second of throughput in the outbound direction. Syntax ^packetsout / 3600 Formula Input Input: packetsout Source: Packets Out (Formula) Generic Database Alias Formula Editor Path AP > Specific > CME > Cisco > NetFlow 74 Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X

Chapter 7: Bulk Collection Formulas Packets Out Type Import This collection formula represents the number of packets in the outbound direction for a Netflow device. Syntax #Bulk Metric Generic Database Alias Formula Editor Path AP > Specific > Bulk > Cisco > NetFlow Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 75

Chapter 7: Bulk Collection Formulas Packets Type Import This collection formula represents the total number of packets for a Netflow device. Syntax #Bulk Metric Generic Database Alias Formula Editor Path AP > Specific > Bulk > Cisco > NetFlow 76 Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X

Chapter 7: Bulk Collection Formulas PacketsTotal Type CME Created by CME Formula Editor Syntax a b packetsin isnil iftrue:[a:=0] iffalse:[a:=packetsin]. packetsout isnil iftrue:[b:=0] iffalse:[b:=packetsout]. ^(a+b) Formula Input Input: packetsin Source: Packets In (Formula) Input: packetsout Source: Packets Out (Formula) Generic Database Alias Packets Formula Editor Path AP > Specific > CME > Cisco > NetFlow Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 77

Chapter 7: Bulk Collection Formulas NOTES 78 Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X

Appendix A: Configuration This appendix explains how to configure the NetFlow IPFIX Technology Pack and consists of the following topics: Topic Page Overview 79 Before You Begin 79 Configure the Technology Pack 80 Other Tasks and Considerations 89 Overview The NetFlow IPFIX Technology Pack is a BULK (or UBA) technology pack. BULK technology packs collect data against non-snmp devices, and rely on the Universal Bulk Adaptor (UBA) of the Netcool/Proviso DataChannel to process the data. Prior to Netcool/Proviso 443, BULK packs could be very difficult to configure, and in many cases required extensive Netcool/Proviso domain knowledge. Netcool/Proviso 443 introduces a graphical user interface (GUI) to configure Netcool/Proviso UBA technology packs on supported Netcool/Proviso platforms. Before You Begin Before configuring the NetFlow IPFIX Technology Pack, ensure that you: Have the following software and documentation for your version of Netcool/Proviso: Release notes for the current technology pack release. Netcool/Proviso Installation Guide. Netcool/Proviso Upgrade Guide (if performing an upgrade). Netcool/Proviso DataMart Configuration Guide. Important: You will need to refer to this guide in order to create an inventory profile and initiate a discovery. Access to the Netcool/Proviso DataMart server. An X Window server on the DataMart server. Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 79

Appendix A: Configuration Note: (Pre-443 Netcool/Proviso) If there is no graphics card on the DataMart server, you can install the Xvfb virtual frame buffer package to provide X Window services, as described in the Netcool/Proviso Installation Guide. Access to the SilverStream server. Access to the DataChannel server. Have completed the following tasks: Reviewed the release notes for the current technology pack. Important: Release notes contain important information you need to consider before installing a technology pack. They also contain information on specific patches that need to be installed before you configure a technology pack. Installed the current version of the Netcool/Proviso components, as described in the Netcool/Proviso Installation Guide. Installed the NetFlow IPFIX Technology Pack. Note: Installation instructions for a technology pack can be found in the Appendices of the Netcool/Proviso Installation Guide (covers core and technology packs). Upgrade instructions for a technology pack can be found in Chapter 3 of the Netcool/Proviso Upgrade Guide (covers core and technology packs). Configured at least one DataChannel. Configured a UBA Bulk Collector subchannel. Installed and configured the Aurora Netflow Collector as described in Appendix D, Aurora Netflow Collector Installation and Configuration. Configure the Technology Pack To configure the NetFlow IPFIX Technology Pack, follow these steps: Important: Localization is now done automatically during installation of the technology pack and requires no manual steps to configure. 1. Load the DataMart Environment. To load the shell with the DataMart environment, follow these steps: 1-a. Log in to the DataMart server as pvuser. 1-b. Change your working directory to the DataMart home directory (/opt/datamart, by default), using the following command: 1-c. cd /opt/datamart Load the shell with the DataMart environment, by sourcing the datamart.env file, as follows:. /opt/datamart/datamart.env Note: After you load the DataMart environment into the shell, the PVMHOME variable is set to the DataMart home directory, /opt/datamart by default. These instructions assume that this variable has been set. 2. Copy the Technology-Specific Files. 80 Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X

Appendix A: Configuration Technology-specific files are used to associate a UBA technology pack with a specific instance of the UBA. Note: While it is possible to install DataMart and DataChannel on the same server, in a typical installation these modules are installed on separate servers. If this is the case, use ftp to copy the technology-specific files. Otherwise, if DataMart and DataChannel are on the same server, use the cp command to copy the files to the appropriate DataChannel directory. To copy technology-specific files to the DataChannel server, follow these steps: 2-a. Log in to the Netcool/Proviso DataChannel server by entering the username and password that you specified when installing and configuring a DataChannel. The default username and password are pvuser and PV, respectively. 2-b. Change your working directory to the DATA_CHANNEL_HOME/scripts directory by entering the following command, replacing DATA_CHANNEL_HOME with the DataChannel home directory (/opt/datachannel, by default): 2-c. $ cd DATA_CHANNEL_HOME/scripts Create a technology pack-specific directory for the scripts $ mkdir cisco_netflow 2-d. Change to this directory 2-e. 2-f. 2-g. $ cd cisco_netflow Using the ftp utility in text mode, log into the DataMart server using the appropriate username and password (pvuser and PV, by default). Using the cd sub-command, change your working directory to the $PVMHOME/APFiles/cisco_netflow/datachannel/scripts/cisco_netflow directory. Using the get sub-command, copy the Bulk Adaptor Design Files (*.js), scripts (if any), and other files (if any) from the DataMart server to the DataChannel server. 2-h. (Pre-443 Netcool/Proviso only) Copy the cisco_netflow_sample_dc.cfg template file as follows: 2-i. 2-j. * Using the cd sub-command, change your working directory to the $PVMHOME/APFiles/cisco_netflow/datachannel/conf directory. * Using the get sub-command, copy the cisco_netflow_sample_dc.cfg template file from the DataMart server to the DataChannel server. Exit the ftp utility by entering the bye sub-command. Verify that the technology-specific files now reside in the target directory as follows: * (Netcool/Proviso 443 and higher) Verify that the Bulk Adaptor Design Files (*.js), scripts (if any), other files (if any) now reside in the DATA_CHANNEL_HOME/scripts directory. * (Pre-443 Netcool/Proviso) Verify that the Bulk Adaptor Design Files (*.js), scripts (if any), other files (if any), and cisco_netflow_sample_dc.cfg template file now reside in the DATA_CHANNEL_HOME/scripts directory. Note: While it is possible to install DataMart and DataChannel on the same server, in a typical installation these modules are installed on separate servers. If this is the case, use ftp to copy the technology-specific files. Otherwise, if DataMart and DataChannel are on the same server, use the cp command to copy the files to the appropriate DataChannel directory. To copy technology-specific files to the DataChannel server, follow these steps: 2-k. Log in to the Netcool/Proviso DataChannel server by entering the username and password that you specified when installing and configuring a DataChannel. The default username and password are pvuser and PV, respectively. Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 81

Appendix A: Configuration 2-l. Change your working directory to the DATA_CHANNEL_HOME/scripts directory by entering the following command, replacing DATA_CHANNEL_HOME with the DataChannel home directory (/opt/datachannel, by default): $ cd DATA_CHANNEL_HOME/scripts 2-m. Using the ftp utility in text mode, log into the DataMart server using the appropriate username and password (pvuser and PV, by default). 2-n. Using the cd sub-command, change your working directory to the $PVMHOME/APFiles/cisco_netflow/datachannel/scripts directory. 2-o. Using the get sub-command, copy the Bulk Adaptor Design Files (*.js), scripts (if any), and other files (if any) from the DataMart server to the DataChannel server. 2-p. (Pre-443 Netcool/Proviso only) Copy the cisco_netflow_sample_dc.cfg template file as follows: * Using the cd sub-command, change your working directory to the $PVMHOME/APFiles/cisco_netflow/datachannel/conf directory. * Using the get sub-command, copy the cisco_netflow_sample_dc.cfg template file from the DataMart server to the DataChannel server. 2-q. Exit the ftp utility by entering the bye sub-command. 2-r. Verify that the technology-specific files now reside in the target directory as follows: * (Netcool/Proviso 443 and higher) Verify that the Bulk Adaptor Design Files (*.js), scripts (if any), other files (if any) now reside in the DATA_CHANNEL_HOME/scripts directory. * (Pre-443 Netcool/Proviso) Verify that the Bulk Adaptor Design Files (*.js), scripts (if any), other files (if any), and cisco_netflow_sample_dc.cfg template file now reside in the DATA_CHANNEL_HOME/scripts directory. 3. Activate data collection requests. During installation of the technology pack, all predefined data collection requests are promoted to the database and set to inactive (that is, idle displays in the Active column of the Netcool/Proviso DataMart Request Editor). You need to activate these predefined data collection requests using the Request Editor. To set data collection requests to active, follow these steps: 3-a. Change your working directory to $PVMHOME/bin (/opt/datamart/bin, by default) on the DataMart server. 3-b. Invoke the DataMart GUI by entering the following command and pressing Enter: 3-c. pvm Click the Configuration tab, then click Request Editor to open the Request Editor. 3-d. Click the Collection tab. 3-e. 3-f. 3-g. Click Refresh. The predefined data collection requests are loaded into the Request Editor from the database. Click the Inactive button in the Filter group box to display only idle requests. In the Sub-Element Groups pane, select all idle data collection requests in the following group or groups: Root->Sub-Element Collect->Cisco NetFlow 3-h. Click the Active box under Details. The Request Editor toggles the idle setting for these data collection requests from idle to active in the Active column. 3-i. Click Save. 82 Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X

Appendix A: Configuration 4. Edit pack-specific UBA parameters, based on the following Netcool/Proviso platforms: 443 and higher Pre-443 443 and Higher In this release of Netcool/Proviso, you were instructed to modify the technology pack-specific UBA parameters when you installed the NetFlow IPFIX Technology Pack, using the Topology Editor. If you did not modify the UBA parameters with site-specific values or you want to make additional edits, you can do so now. Otherwise, you can go to the next step. See the Installing Technology Packs chapter of the Netcool/Proviso Installation Guide for more information. Pre-443 The NetFlow IPFIX Technology Pack requires specific UBA parameters that are not in the dc.cfg file. The DataChannel installer creates a dc.cfg file in the DATA_CHANNEL_HOME/conf directory (/opt/datachannel/conf, by default). These pack-specific parameters were delivered in a template file called cisco_netflow_sample_dc.cfg. The best practice on adding these pack-specific parameters to the dc.cfg file is to: Edit the pack-specific UBA parameters in the template file with site-specific values. Manually add them to the dc.cfg file. To edit the pack-specific UBA parameters in the template file with site-specific values, follow these steps: 4-a. On the DataChannel server, change your working directory to the DATA_CHANNEL_HOME/scripts directory by entering the following command, replacing DATA_CHANNEL_HOME with the DataChannel home directory (/opt/datachannel, by default): cd DATA_CHANNEL_HOME/scripts 4-b. Make a backup copy of the cisco_netflow_sample_dc.cfg template file, by entering the following command: cp cisco_netflow_sample_dc.cfg cisco_netflow_sample_dc.cfg.orig 4-c. In a text editor, open the cisco_netflow_sample_dc.cfg template file for editing. 4-d. Edit the pack-specific UBA parameters according to the instructions provided in Appendix C, Template File Reference (Pre-443 Only). 4-e. 4-f. 4-g. When you are satisfied with your edits, write (but do not quit) the cisco_netflow_sample_dc.cfg template file. Important: Editing the dc.cfg file is a non-trivial task and prone to error. Take your time and check your work carefully. To manually add the pack-specific UBA parameters to the dc.cfg file, follow these steps: Open a second terminal emulator. On the DataChannel server, change your working directory to the DATA_CHANNEL_HOME/conf directory (/opt/datachannel/conf, by default), by entering the following command: cd DATA_CHANNEL_HOME/conf 4-h. Make a backup copy of the dc.cfg file, by entering the following command: 4-i. cp dc.cfg dc.cfg.orig In a text editor, open the dc.cfg file for editing. Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 83

Appendix A: Configuration 4-j. Search for the UBA parameters, which begin with the string UBA. These parameters were written to the dc.cfg file when you configured the UBA Bulk Collector and installed the DataChannel configuration, as described in the Netcool/Proviso Installation Guide. 4-k. Copy the pack-specific UBA parameters from the cisco_netflow_sample_dc.cfg template file to the dc.cfg file. 4-l. When you are satisfied with your edits, do the following: Quit the cisco_netflow_sample_dc.cfg template file. Write and quit the dc.cfg file. 5. Load the DataChannel environment. In subsequent steps, you will execute dccmd commands. To ensure that you can run these commands, load the shell with the DataChannel environment by following these steps: 5-a. Log in to the DataChannel server as pvuser. 5-b. Change your working directory to the DataChannel home directory (/opt/datachannel, by default), using the following command: 5-c. cd /opt/datachannel Load the shell with the DataChannel environment, by sourcing the datachannel.env file, as follows:. /opt/datachannel/datachannel.env 6. Restart the DataChannel to activate the UBA and read in changes to the deployed topology (443 only) or dc.cfg (pre-443 only). 6-a. Open a terminal emulator on the DataChannel server. 6-b. Use the dccmd command to stop all DataChannel applications: 6-c. dccmd -action stop all Use the dccmd command to release all daemons running in the DataChannel: dccmd -action forget all 6-d. Use the following command to find the process identifiers (pids) associated with the DataChannel visual processes: 6-e. 6-f. 6-g. DATA_CHANNEL_HOME/bin/findvisual where: DATA_CHANNEL_HOME is /opt/datachannel, by default. Use the following commands to stop each DataChannel visual process: kill -9 <cnsw_pid> kill -9 <logw_pid> kill -9 <amgrw_pid> kill -9 <cmgrw_pid> Use the following commands to restart each DataChannel visual process: cnsw logw amgrw cmgrw Use the dccmd command to start all DataChannel applications: 84 Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X

Appendix A: Configuration dccmd -action start all 6-h. Use the dccmd command to verify that all of the DataChannel applications started properly: 6-i. dccmd -action status all More specifically, make sure that the UBA application associated with the DataChannel you configured for the NetFlow IPFIX Technology Pack is running. Watch the output of the status switch to verify that all the necessary processes are running. If these processes are running, run the tail utility on the log file for the UBA by issuing a command similar to the following: tail -f DATA_CHANNEL_HOME/log/proviso.log grep UBA.<channel>.<collector>- more where: Variable DATA_CHANNEL_HOME <channel> <collector> The trailing dash ( ) after <collector> Meaning Is /opt/datachannel, by default. Specifies the channel number (for example, 1) you specified when configuring this DataChannel. Specifies the collector number (for example, 100) you specified when configuring this UBA Bulk Collector. Removes extraneous log messages from your view. That is, the trailing dash guarantees that the command displays only those messages generated by your application. The first set of messages relate to syntax checks. The following table identifies some events to watch for during the syntax check: Event The UBA application starts successfully, but then stops executing. The Bulk Adaptor Design File might be corrupt. The UBA application connects to the database. Meaning Typically, this event occurs because of a licensing issue. This event causes a syntax error before the UBA application connects to the database. This event causes a message similar to the following to display: DB_CONNECT Connecting to <sid> as <user> If you see this database connection message without prior errors, the UBA application has passed the syntax check. 7. Ensure That the Bulk Input Files Can Be Read. To verify that the UBA application can read the Bulk input files, follow these steps: 7-a. Place a Bulk input file at the source input location. (443 only) The source input location for Bulk input files is specified using the URI parameter from the pack s XSD file, which you can view using the Topology Editor. Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 85

Appendix A: Configuration (Pre-443 only) The source input location for Bulk input files is specified using the URI parameter from the template file, which you added to the dc.cfg file in a previous step. Within the configured file retrieval interval (typically, five minutes), the UBA application retrieves the Bulk input file and copies it to the following directory: DATA_CHANNEL_HOME/UBA.<channel>.<collector>/<instance>/do/ where: Variable DATA_CHANNEL_HOME <channel> <collector> <instance> (443 only) <instance> (pre-443 only) Meaning Is /opt/datachannel, by default. Specifies the channel number (for example, 1) you specified when configuring this DataChannel. Specifies the collector number (for example, 100) you specified when configuring this UBA Bulk Collector. Specifies the string for the INSTANCES parameter in the pack s XSD file. Typically, this string represents the name of the pack and is read-only. You can view the string specified for INSTANCES using the Topology Editor. Specifies the string for the INSTANCES parameter in the pack s template file. You were instructed to copy this parameter to the dc.cfg file in a previous step. The UBA application then processes the Bulk input file according to the instructions in the Bulk Adaptor Design File. Note: The first time that the UBA processes a Bulk input file, it passes a metric to the CME. The CME rejects this metric as a BAD_METRIC because the metric does not have an associated grouped sub-element prior to the time this metric is recorded. This is expected behavior. The CME accepts metrics from the Bulk input files after the inventory is run. 7-b. Ensure that the UBA application can successfully read the Bulk input file you copied into the source input location by issuing a tail utility command similar to the following: tail -f DATA_CHANNEL_HOME/log/proviso.log grep UBA.<channel>.<collector>- more The following table identifies the success messages you should look for. Line breaks appear in the messages to make them more readable. Success Message PERF_INPUT_PROCESSING Processed <integer> records in <float> seconds (<float> records/minute): <int> records Meaning Specifies a Bulk Adaptor Design File completion message. A Bulk Adaptor Design File successfully completes when an informational message similar to this one displays in the log file. Success occurs when <int> records equals 0. 86 Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X

Appendix A: Configuration Success Message METRIC_STREAM_INFO Completed writing metric output: DATA_CHANNEL_HOME/UBA.<channel>.<collector>/streaming/ state/temp/output/<time>.<instance>.nraw.bof; wrote <int> metrics; <int> bad resource IDs; <int> bad formula names (#()) Meaning Specifies a metric creation success message. The UBA application successfully creates metrics when a debug 2 message similar to this one displays in the log file. For some technology packs, the metric creation may be done across different instances of UBA applications. Success occurs when <int> metrics is greater than one, <int> bad resource IDs equals 0, and <int> bad formula names equals 0. PERF_INVFLUSH Inserted/updated <int> inventory objects in <float> seconds Specifies an inventory success message. The inventory successfully completes when an informational message similar to this one displays in the log file. If <int> is greater than one, the UBA application created or updated at least one sub-element, and the inventory process is successful. The log file might record further details (if necessary) in the messages associated with the PERF_INVFLUSHPV sub-element message category. 8. Run the Bulk Inventory Profile. The UBA application handles the inventory and metrics according to the instructions provided in the technology pack s design file or files. Specifically, the UBA application inserts the created elements, subelements, and metrics into the database. However, the UBA application does not handle the grouping of these elements and sub-elements. To handle the grouping of the elements and sub-elements that were inserted into the database, UBA technology packs supply a Bulk inventory profile. This Bulk inventory profile is automatically created when the pack is installed. Bulk inventory profiles use the following name syntax: bulk_n where: Syntax Item bulk_ N Meaning Identifies this as a Bulk inventory profile for a UBA technology pack. Specifies the collector number (for example, 100) the user specified when configuring this UBA Bulk Collector. You must use the Inventory Tool to run a Bulk inventory profile. To run this technology pack s Bulk inventory profile, perform the following steps: Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 87

Appendix A: Configuration 8-a. In the command window where you loaded the DataMart environment, change your working directory to $PVMHOME/bin (/opt/datamart/bin, by default) on the DataMart server. 8-b. Invoke the DataMart GUI by entering the following command and pressing Enter: 8-c. pvm Click Inventory Tool in the Resource tab. The Inventory Tool window appears. This window displays a list of the existing inventory profiles on the Configuration tab. The name of the inventory profile to run is bulk_n, where N is the collector number configured for this pack. 8-d. On the Configuration tab, click on the Bulk inventory profile for this technology pack and then select Run Profile from the Action menu. 8-e. The Live Information tab displays messages about the status of the profile. See the Netcool/Proviso DataMart Configuration Guide for more information about running an inventory profile. (Optional) Every time the UBA technology pack s design file creates new elements, sub-elements, and metrics, you need to perform the previous steps to group the elements and sub-elements. One way to accomplish this task on a regular basis is to create a cron entry that make use of the inventory CLI command. The following example shows a cron entry that periodically performs the grouping operation for a Bulk inventory profile called bulk_100: 0 * * * *. /opt/datamart/datamart.env && inventory -name bulk_100 -action pregrouping -reload -nox 0 * * * *. /opt/datamart/datamart.env && inventory -name bulk_100 -action grouping -reload -nox See the Netcool/Proviso Command Line Interface Guide for more information about the inventory command. 9. Deploy Reports. After the technology pack installation completes, the rules for the new device are automatically loaded into the database. The inventory process uses those rules to group elements and sub-elements. You must manually deploy (auto-group) the reports by associating them with groups in the DataMart Resource Editor s NOC Reporting tree. To deploy the NetFlow IPFIX Technology Pack reports, follow these steps: 9-a. Open the Netcool/Proviso DataMart Resource Editor. 9-b. Click the ReportSEGroup tab. 9-c. Move the cursor to the left pane and scroll up to select any group under the SUB-ELEMENTS->NOC Reporting tree. 9-d. Right-click and select the AutoGrouping option from the menu. The AutoGrouping option places the reports in dynamically generated groups created during inventory. 9-e. 9-f. 9-g. Click Yes to continue. Click Close to exit the message box, or click Details to view a description of any errors. (Optional) You can also deploy reports on a regular basis by creating a cron entry that makes use of the inventory CLI command and the -reportgrouping option. This option instructs the inventory command to run the report grouping rules and update the deployed reports stored in the database. Report grouping rules must first have been created before this option can be used. For information on creating report grouping rules, see the Netcool/Proviso DataMart Configuration Guide. The following example shows a cron entry that periodically performs the deploy report operation: 0 * * * *. /opt/datamart/datamart.env && inventory -nox -reportgrouping See the Netcool/Proviso Command Line Interface Guide for more information about the inventory command. 88 Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X

Appendix A: Configuration Other Tasks and Considerations This section contains information on the following topics: Verify Resources Verify Resources Use the Netcool/Proviso DataMart Resource Editor to determine if the technology pack s resources (elements, sub-elements, properties, and so forth) were successfully discovered and created in the database during inventory. See the Netcool/Proviso DataMart Configuration Guide for information on using the Netcool/Proviso DataMart Resource Editor. Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 89

Appendix A: Configuration NOTES 90 Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X

Appendix B: UBA Parameters Reference (Netcool/Proviso 443 and Higher) This appendix provides UNIX reference pages for each of the pack-specific UBA parameters supplied with the XSD file for the NetFlow IPFIX Technology Pack. The descriptions are the same as those that display in the Topology Editor Help. These reference pages are provided as a convenience. This appendix contains the following topics: Topic Page UBA Parameters Reference 91 Custom Parameters 127 Enabling Host reporting 128 UBA Parameters Reference The following pages provide a reference of the UBA parameters that this technology pack provides. The reference pages have the following sections: Parameter name. Each reference page begins with the parameter name. Parameter names use the following syntax: where: [<device>.][<instance>.][<schema>.]<parameter_name> <device> Specifies the name of the device. <instance> Specifies the group alias, which is typically a string that represents the name of the technology pack. <schema> Specifies the string passed to the input schema object referenced in the pack s Bulk Adaptor Design (JavaScript) file. <parameter_name> Specifies the name of the parameter. In the Detail sections of the reference pages, parameter names in the descriptions are typically referenced as <schema>.<parameter_name> or simply <parameter_name>. The descriptions do not reference the <device> or <instance> part of the parameter name.. A short description that identifies the purpose of the parameter. Component. The DataChannel application (component) to which the parameter applies. The value specified for this parameter controls the behavior of this DataChannel application. This section can contain the following values: BLB Specifies the DataChannel BLB (Bulk Load Balancer) application. IF Specifies the DataChannel Inventory File (IF) application. Examples of IF applications include: Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 91

Appendix B: UBA Parameters Reference (Netcool/Proviso 443 and Higher) * SAMIF Specifies the IF application for the Alcatel 5620 SAM Technology Pack. * QCIF Specifies the IF application for the Alcatel 5620 NM Technology Pack. * CWMIF Specifies the IF application for the Cisco CWM Technology Pack. UBA Specifies the DataChannel UBA (Universal Bulk Adaptor) application. Most UBA technology packs operate with only the UBA application. Value. Specifies the following information: Default Identifies the default value, if one is specified, for the parameter. Attribute Specifies whether the parameter is writable. Location Specifies the location of the parameter in the Topology Editor. Detail. Provides details about the parameter, including possible values. 92 Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X

Appendix B: UBA Parameters Reference (Netcool/Proviso 443 and Higher) CISCO_NETFLOW.APP.LEVEL Granularity of debug messages for AppLogger Component UBA Value Default: 3 Attribute: Writable Location: Advanced Properties tab Detail The APP.LEVEL parameter specifies the granularity of messages that are logged. The higher the number, the less important the message. The debug messages are marked 0 (zero) to 10. To change the level of debug messages obtained on a specific DataChannel application, specify a value between 0 (zero) and 10 inclusive. If APP.LOGGING is set to FALSE, the APP.LEVEL parameter has no effect. Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 93

Appendix B: UBA Parameters Reference (Netcool/Proviso 443 and Higher) CISCO_NETFLOW.APP.LOGGING Enables the AppLogger facility Component UBA Value Default: Attribute: Location: false Writable Advanced Properties tab Detail Netcool/Proviso application packs provide a logging facility called AppLogger. The purpose of AppLogger is to provide a minimal level of control over the log messages used for debugging by Micromuse application pack developers. It might be necessary for Micromuse Professional Services to enable AppLogger debug messages if it becomes necessary to perform some debugging operations. There are two parameters: APP.LOGGING and APP.LEVEL used to control AppLogger debug messages. The APP.LOGGING parameter specifies whether to enable AppLogger debug messages for a specific DataChannel application. To enable AppLogger debug messages, specify the value TRUE. Otherwise, to disable AppLogger debug messages, specify the value FALSE. 94 Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X

Appendix B: UBA Parameters Reference (Netcool/Proviso 443 and Higher) CISCO_NETFLOW.CSV_DATA.DELETEONACQUIRE Deletes files after acquisition Component UBA Value Default: Attribute: Location: true Writable Advanced Properties tab Detail The CSV_DATA.DELETEONACQUIRE parameter specifies whether the Bulk input files should be preserved after the UBA acquires them. A related parameter - CSV_DATA.URI - specifies the location of the Bulk input files. Set this parameter to the value true to instruct this UBA application to delete the Bulk input files after it acquires them. Otherwise, set this parameter to false to instruct this UBA application to preserve the Bulk input files after it acquires them. Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 95

Appendix B: UBA Parameters Reference (Netcool/Proviso 443 and Higher) CISCO_NETFLOW.CSV_DATA.URI Bulk input files location Component UBA Value Default: Attribute: Location: No default value Read-only Properties tab Detail The DataChannel applications that handle inventory and metrics must be directed to the location of the Bulk input files generated by the devices associated with the technology on which the application operates. The CSV_DATA.URI parameter specifies the location, in Universal Resource Identifier (URI) format, for the specified DataChannel applications to retrieve these Bulk input files. A related parameter - CSV_DATA.DELETEONACQUIRE - specifies whether the UBA application should delete the Bulk input files after it acquires them. The CSV_DATA.URI parameter is read-only. To change the transport mechanism (ftp or secure ftp), hostname, username, password or input directory fields of the URI specification, edit these parameters: *INPUT_USE_SECURE_FTP *INPUT_FTP_HOST *INPUT_FTP_USERNAME *INPUT_FTP_PASSWORD *INPUT_DIRECTORY NOTE: The actual wildcard used to specify the Bulk input files to be acquired is automatically specified in the CSV_DATA.URI parameter. 96 Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X

Appendix B: UBA Parameters Reference (Netcool/Proviso 443 and Higher) CISCO_NETFLOW.DESIGNFILE JavaScript file that controls UBA Component UBA Value Default: Attribute: Location: cisco_netflow/cisconetflowadaptor.js Read-only Properties tab Detail Netcool/Proviso application packs control the behavior of the DataChannel UBA application through instructions contained in Bulk Adaptor design (JavaScript) files. The DESIGNFILE parameter identifies the name of an application pack s design file. This is a read-only parameter. You cannot change the name of the application pack s Bulk Adaptor design file. Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 97

Appendix B: UBA Parameters Reference (Netcool/Proviso 443 and Higher) CISCO_NETFLOW.INPUT_DIRECTORY Path to Bulk input files directory Component UBA Value Default: Attribute: Location: /var/lib/aurora/sites/proviso/reports Writable Properties tab Detail The INPUT_DIRECTORY parameter specifies the path to the directory where the generated Bulk input files should be stored. Do not enter any subdirectories and the actual wildcard used to specify the Bulk input files to be acquired. Any subdirectories and wildcard are automatically specified in the CSV_DATA.URI parameter. An example of an input directory specification is opt/uba. 98 Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X

Appendix B: UBA Parameters Reference (Netcool/Proviso 443 and Higher) CISCO_NETFLOW.INPUT_FTP_PASSWORD FTP or SFTP password for Bulk input files Component UBA Value Default: Attribute: Location: No default value Writable Properties tab Detail The INPUT_FTP_PASSWORD parameter specifies the password that the server administrator assigned (using the ftp or sftp utility) to the FTP or SFTP user. The FTP or SFTP user specifies this password to gain access to the server on which the Bulk input files reside. Likewise, the UBA uses this same password to gain access to the server on which the Bulk input files reside. Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 99

Appendix B: UBA Parameters Reference (Netcool/Proviso 443 and Higher) CISCO_NETFLOW.INPUT_FTP_USERNAME FTP or SFTP username for Bulk input files Component UBA Value Default: Attribute: Location: No default value Writable Properties tab 100 Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X

Appendix B: UBA Parameters Reference (Netcool/Proviso 443 and Higher) CISCO_NETFLOW.INPUT_HOST Hostname for Bulk input files Component UBA Value Default: Attribute: Location: No default value Writable Properties tab Detail The INPUT_HOST parameter specifies the hostname of the server on which the Bulk input files reside. These are the files that the UBA parses. Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 101

Appendix B: UBA Parameters Reference (Netcool/Proviso 443 and Higher) CISCO_NETFLOW.INPUT_USE_SECURE_FTP Acquire Bulk input files using secure FTP Component UBA Value Default: Attribute: Location: false Writable Properties tab Detail The INPUT_USE_SECURE_FTP parameter specifies whether FTP (File Transfer Protocol) or SFTP (secure FTP) is used. To use FTP, specify the value false. Otherwise, to use SFTP, specify the value true. The default value is false. To use the sftp command, you must have an SSH client installed on the servers where the Bulk input files reside and where the DataChannel is running. Typically, an SSH client is installed by default on most Unix systems. For more information, see your operating system documentation or the sftp manpage. NOTE: You cannot do the following: *Use an FTP client to connect to an SFTP server *Connect to an FTP server with a client that supports only SFTP 102 Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X

Appendix B: UBA Parameters Reference (Netcool/Proviso 443 and Higher) CISCO_NETFLOW.PROPERTIES.APPLICATION PROPERTIES Component UBA Value Default: Attribute: Location: NF_Application Writable Advanced Properties tab Detail The PROPERTIES parameter is read-only. It displays a look-up table that contains the Aurora parameters mapped to their associated Netcool/Proviso properties. It allows Proviso to create objects for each of the Netflow objects used. The property definition statement uses the following format: aurora_object=proviso_property Where aurora_object=proviso_property represent the Aurora object and Netcool/Proviso properties used to generate the CSV files. See the Netcool/Proviso NetFlow Application Pack User s Guide for more information on the CSV format. Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 103

Appendix B: UBA Parameters Reference (Netcool/Proviso 443 and Higher) CISCO_NETFLOW.PROPERTIES.ASN_DST PROPERTIES Component UBA Value Default: Attribute: Location: NF_DstAsNum Writable Advanced Properties tab Detail The PROPERTIES parameter is read-only. It displays a look-up table that contains the Aurora parameters mapped to their associated Netcool/Proviso properties. It allows Proviso to create objects for each of the Netflow objects used. The property definition statement uses the following format: aurora_object=proviso_property Where aurora_object=proviso_property represent the Aurora object and Netcool/Proviso properties used to generate the CSV files. See the Netcool/Proviso NetFlow Application Pack User s Guide for more information on the CSV format. 104 Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X

Appendix B: UBA Parameters Reference (Netcool/Proviso 443 and Higher) CISCO_NETFLOW.PROPERTIES.ASN_SRC PROPERTIES Component UBA Value Default: Attribute: Location: NF_SrcAsNum Writable Advanced Properties tab Detail The PROPERTIES parameter is read-only. It displays a look-up table that contains the Aurora parameters mapped to their associated Netcool/Proviso properties. It allows Proviso to create objects for each of the Netflow objects used. The property definition statement uses the following format: aurora_object=proviso_property Where aurora_object=proviso_property represent the Aurora object and Netcool/Proviso properties used to generate the CSV files. See the Netcool/Proviso NetFlow Application Pack User s Guide for more information on the CSV format. Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 105

Appendix B: UBA Parameters Reference (Netcool/Proviso 443 and Higher) CISCO_NETFLOW.PROPERTIES.DESTMASK PROPERTIES Component UBA Value Default: Attribute: Location: NF_Destmask Writable Advanced Properties tab Detail The PROPERTIES parameter is read-only. It displays a look-up table that contains the Aurora parameters mapped to their associated Netcool/Proviso properties. It allows Proviso to create objects for each of the Netflow objects used. The property definition statement uses the following format: aurora_object=proviso_property Where aurora_object=proviso_property represent the Aurora object and Netcool/Proviso properties used to generate the CSV files. See the Netcool/Proviso NetFlow Application Pack User s Guide for more information on the CSV format. 106 Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X

Appendix B: UBA Parameters Reference (Netcool/Proviso 443 and Higher) CISCO_NETFLOW.PROPERTIES.DOMAIN PROPERTIES Component UBA Value Default: Attribute: Location: NF_NetworkName Writable Advanced Properties tab Detail The PROPERTIES parameter is read-only. It displays a look-up table that contains the Aurora parameters mapped to their associated Netcool/Proviso properties. It allows Proviso to create objects for each of the Netflow objects used. The property definition statement uses the following format: aurora_object=proviso_property Where aurora_object=proviso_property represent the Aurora object and Netcool/Proviso properties used to generate the CSV files. See the Netcool/Proviso NetFlow Application Pack User s Guide for more information on the CSV format. Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 107

Appendix B: UBA Parameters Reference (Netcool/Proviso 443 and Higher) CISCO_NETFLOW.PROPERTIES.DOMAIN_DST PROPERTIES Component UBA Value Default: Attribute: Location: NF_DestNet Writable Advanced Properties tab Detail The PROPERTIES parameter is read-only. It displays a look-up table that contains the Aurora parameters mapped to their associated Netcool/Proviso properties. It allows Proviso to create objects for each of the Netflow objects used. The property definition statement uses the following format: aurora_object=proviso_property Where aurora_object=proviso_property represent the Aurora object and Netcool/Proviso properties used to generate the CSV files. See the Netcool/Proviso NetFlow Application Pack User s Guide for more information on the CSV format. 108 Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X

Appendix B: UBA Parameters Reference (Netcool/Proviso 443 and Higher) CISCO_NETFLOW.PROPERTIES.DOMAIN_SRC PROPERTIES Component UBA Value Default: Attribute: Location: NF_SourceNet Writable Advanced Properties tab Detail The PROPERTIES parameter is read-only. It displays a look-up table that contains the Aurora parameters mapped to their associated Netcool/Proviso properties. It allows Proviso to create objects for each of the Netflow objects used. The property definition statement uses the following format: aurora_object=proviso_property Where aurora_object=proviso_property represent the Aurora object and Netcool/Proviso properties used to generate the CSV files. See the Netcool/Proviso NetFlow Application Pack User s Guide for more information on the CSV format. Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 109

Appendix B: UBA Parameters Reference (Netcool/Proviso 443 and Higher) CISCO_NETFLOW.PROPERTIES.INTERFACE_IN PROPERTIES Component UBA Value Default: Attribute: Location: NF_InputIFIndex Writable Advanced Properties tab Detail The PROPERTIES parameter is read-only. It displays a look-up table that contains the Aurora parameters mapped to their associated Netcool/Proviso properties. It allows Proviso to create objects for each of the Netflow objects used. The property definition statement uses the following format: aurora_object=proviso_property Where aurora_object=proviso_property represent the Aurora object and Netcool/Proviso properties used to generate the CSV files. See the Netcool/Proviso NetFlow Application Pack User s Guide for more information on the CSV format. 110 Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X

Appendix B: UBA Parameters Reference (Netcool/Proviso 443 and Higher) CISCO_NETFLOW.PROPERTIES.INTERFACE_OUT PROPERTIES Component UBA Value Default: Attribute: Location: NF_OutputIFIndex Writable Advanced Properties tab Detail The PROPERTIES parameter is read-only. It displays a look-up table that contains the Aurora parameters mapped to their associated Netcool/Proviso properties. It allows Proviso to create objects for each of the Netflow objects used. The property definition statement uses the following format: aurora_object=proviso_property Where aurora_object=proviso_property represent the Aurora object and Netcool/Proviso properties used to generate the CSV files. See the Netcool/Proviso NetFlow Application Pack User s Guide for more information on the CSV format. Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 111

Appendix B: UBA Parameters Reference (Netcool/Proviso 443 and Higher) CISCO_NETFLOW.PROPERTIES.IP_DST PROPERTIES Component UBA Value Default: Attribute: Location: NF_DestIPAddress Writable Advanced Properties tab Detail The PROPERTIES parameter is read-only. It displays a look-up table that contains the Aurora parameters mapped to their associated Netcool/Proviso properties. It allows Proviso to create objects for each of the Netflow objects used. The property definition statement uses the following format: aurora_object=proviso_property Where aurora_object=proviso_property represent the Aurora object and Netcool/Proviso properties used to generate the CSV files. See the Netcool/Proviso NetFlow Application Pack User s Guide for more information on the CSV format. 112 Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X

Appendix B: UBA Parameters Reference (Netcool/Proviso 443 and Higher) CISCO_NETFLOW.PROPERTIES.IP_NEXTHOP PROPERTIES Component UBA Value Default: Attribute: Location: NF_NextHop Writable Advanced Properties tab Detail The PROPERTIES parameter is read-only. It displays a look-up table that contains the Aurora parameters mapped to their associated Netcool/Proviso properties. It allows Proviso to create objects for each of the Netflow objects used. The property definition statement uses the following format: aurora_object=proviso_property Where aurora_object=proviso_property represent the Aurora object and Netcool/Proviso properties used to generate the CSV files. See the Netcool/Proviso NetFlow Application Pack User s Guide for more information on the CSV format. Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 113

Appendix B: UBA Parameters Reference (Netcool/Proviso 443 and Higher) CISCO_NETFLOW.PROPERTIES.IP_ROUTER PROPERTIES Component UBA Value Default: Attribute: Location: NF_Router Writable Advanced Properties tab Detail The PROPERTIES parameter is read-only. It displays a look-up table that contains the Aurora parameters mapped to their associated Netcool/Proviso properties. It allows Proviso to create objects for each of the Netflow objects used. The property definition statement uses the following format: aurora_object=proviso_property Where aurora_object=proviso_property represent the Aurora object and Netcool/Proviso properties used to generate the CSV files. See the Netcool/Proviso NetFlow Application Pack User s Guide for more information on the CSV format. 114 Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X

Appendix B: UBA Parameters Reference (Netcool/Proviso 443 and Higher) CISCO_NETFLOW.PROPERTIES.IP_SRC PROPERTIES Component UBA Value Default: Attribute: Location: NF_SourceIPAddress Writable Advanced Properties tab Detail The PROPERTIES parameter is read-only. It displays a look-up table that contains the Aurora parameters mapped to their associated Netcool/Proviso properties. It allows Proviso to create objects for each of the Netflow objects used. The property definition statement uses the following format: aurora_object=proviso_property Where aurora_object=proviso_property represent the Aurora object and Netcool/Proviso properties used to generate the CSV files. See the Netcool/Proviso NetFlow Application Pack User s Guide for more information on the CSV format. Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 115

Appendix B: UBA Parameters Reference (Netcool/Proviso 443 and Higher) CISCO_NETFLOW.PROPERTIES.PORT_DST PROPERTIES Component UBA Value Default: Attribute: Location: NF_DestPort Writable Advanced Properties tab Detail The PROPERTIES parameter is read-only. It displays a look-up table that contains the Aurora parameters mapped to their associated Netcool/Proviso properties. It allows Proviso to create objects for each of the Netflow objects used. The property definition statement uses the following format: aurora_object=proviso_property Where aurora_object=proviso_property represent the Aurora object and Netcool/Proviso properties used to generate the CSV files. See the Netcool/Proviso NetFlow Application Pack User s Guide for more information on the CSV format. 116 Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X

Appendix B: UBA Parameters Reference (Netcool/Proviso 443 and Higher) CISCO_NETFLOW.PROPERTIES.PORT_SRC PROPERTIES Component UBA Value Default: Attribute: Location: NF_SourcePort Writable Advanced Properties tab Detail The PROPERTIES parameter is read-only. It displays a look-up table that contains the Aurora parameters mapped to their associated Netcool/Proviso properties. It allows Proviso to create objects for each of the Netflow objects used. The property definition statement uses the following format: aurora_object=proviso_property Where aurora_object=proviso_property represent the Aurora object and Netcool/Proviso properties used to generate the CSV files. See the Netcool/Proviso NetFlow Application Pack User s Guide for more information on the CSV format. Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 117

Appendix B: UBA Parameters Reference (Netcool/Proviso 443 and Higher) CISCO_NETFLOW.PROPERTIES.PROTOCOL PROPERTIES Component UBA Value Default: Attribute: Location: NF_Protocol Writable Advanced Properties tab Detail The PROPERTIES parameter is read-only. It displays a look-up table that contains the Aurora parameters mapped to their associated Netcool/Proviso properties. It allows Proviso to create objects for each of the Netflow objects used. The property definition statement uses the following format: aurora_object=proviso_property Where aurora_object=proviso_property represent the Aurora object and Netcool/Proviso properties used to generate the CSV files. See the Netcool/Proviso NetFlow Application Pack User s Guide for more information on the CSV format. 118 Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X

Appendix B: UBA Parameters Reference (Netcool/Proviso 443 and Higher) CISCO_NETFLOW.PROPERTIES.SITE PROPERTIES Component UBA Value Default: Attribute: Location: NF_Site Writable Advanced Properties tab Detail The PROPERTIES parameter is read-only. It displays a look-up table that contains the Aurora parameters mapped to their associated Netcool/Proviso properties. It allows Proviso to create objects for each of the Netflow objects used. The property definition statement uses the following format: aurora_object=proviso_property Where aurora_object=proviso_property represent the Aurora object and Netcool/Proviso properties used to generate the CSV files. See the Netcool/Proviso NetFlow Application Pack User s Guide for more information on the CSV format. Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 119

Appendix B: UBA Parameters Reference (Netcool/Proviso 443 and Higher) CISCO_NETFLOW.PROPERTIES.SOURCEMASK PROPERTIES Component UBA Value Default: Attribute: Location: NF_SourceMask Writable Advanced Properties tab Detail The PROPERTIES parameter is read-only. It displays a look-up table that contains the Aurora parameters mapped to their associated Netcool/Proviso properties. It allows Proviso to create objects for each of the Netflow objects used. The property definition statement uses the following format: aurora_object=proviso_property Where aurora_object=proviso_property represent the Aurora object and Netcool/Proviso properties used to generate the CSV files. See the Netcool/Proviso NetFlow Application Pack User s Guide for more information on the CSV format. 120 Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X

Appendix B: UBA Parameters Reference (Netcool/Proviso 443 and Higher) CISCO_NETFLOW.PROPERTIES.TCP_FLAGS PROPERTIES Component UBA Value Default: Attribute: Location: NF_TSPFlags Writable Advanced Properties tab Detail The PROPERTIES parameter is read-only. It displays a look-up table that contains the Aurora parameters mapped to their associated Netcool/Proviso properties. It allows Proviso to create objects for each of the Netflow objects used. The property definition statement uses the following format: aurora_object=proviso_property Where aurora_object=proviso_property represent the Aurora object and Netcool/Proviso properties used to generate the CSV files. See the Netcool/Proviso NetFlow Application Pack User s Guide for more information on the CSV format. Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 121

Appendix B: UBA Parameters Reference (Netcool/Proviso 443 and Higher) CISCO_NETFLOW.PROPERTIES.TOPIC PROPERTIES Component UBA Value Default: Attribute: Location: NF_Topic Writable Advanced Properties tab Detail The PROPERTIES parameter is read-only. It displays a look-up table that contains the Aurora parameters mapped to their associated Netcool/Proviso properties. It allows Proviso to create objects for each of the Netflow objects used. The property definition statement uses the following format: aurora_object=proviso_property Where aurora_object=proviso_property represent the Aurora object and Netcool/Proviso properties used to generate the CSV files. See the Netcool/Proviso NetFlow Application Pack User s Guide for more information on the CSV format. 122 Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X

Appendix B: UBA Parameters Reference (Netcool/Proviso 443 and Higher) CISCO_NETFLOW.PROPERTIES.TOS PROPERTIES Component UBA Value Default: Attribute: Location: NF_Tos Writable Advanced Properties tab Detail The PROPERTIES parameter is read-only. It displays a look-up table that contains the Aurora parameters mapped to their associated Netcool/Proviso properties. It allows Proviso to create objects for each of the Netflow objects used. The property definition statement uses the following format: aurora_object=proviso_property Where aurora_object=proviso_property represent the Aurora object and Netcool/Proviso properties used to generate the CSV files. See the Netcool/Proviso NetFlow Application Pack User s Guide for more information on the CSV format. Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 123

Appendix B: UBA Parameters Reference (Netcool/Proviso 443 and Higher) CISCO_NETFLOW.TIMEZONE Timezone in which UBA obtains input data Component UBA Value Default: Attribute: Location: No default value Writable Properties tab Detail The TIMEZONE parameter specifies the timezone in which the UBA obtains the input data from the Bulk input files. Typically, application packs deliver this parameter only when the input data is something other than UTC. 124 Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X

Appendix B: UBA Parameters Reference (Netcool/Proviso 443 and Higher) CISCO_NETFLOW.TOPIC_FILTER TOPIC_FILTER Component UBA Value Default: Attribute: Location: Network,NetApp,AsNum,NetMatrix,NetToS Writable Advanced Properties tab Detail The TOPIC_FILTER parameter specifies which NetFlow IPFIX Topics are collected and processed by Netcool/Proviso. This parameter gives you an additional filter on which topics should be allowed through, and can be used to select which report sets get populated by filtering data at the collection level. The available topics are Network, NetApp, AsNum, NetMatrix, NetTos, HostNet, and NetHost. They populate the Network, Network Applications, AS Matrix, Network Matrix, Network ToS and ToS Network (both use the NetTos topic), Host to Network, and Network to Host reports respectively. Removing an item from the comma seperated values will prevent the respective report set from having data collected for it. The topic filter parameter uses a comma separated list format that looks like this: TOPIC_FILTER=topic,topic2,...topicN See the Netcool/Proviso NetFlow Application Pack User s Guide for more information on the NetFlow IPFIX topics/aspects that are available. Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 125

Appendix B: UBA Parameters Reference (Netcool/Proviso 443 and Higher) INSTANCES Group alias Component UBA Value Default: Attribute: Location: CISCO_NETFLOW Read-only Advanced Properties tab Detail The DataChannel supports multiple instances of application packs running in a single channel component. Therefore, there must be a way to guarantee that the DataChannel applications that handle inventory and metrics parse the correct design files and read the appropriate Bulk input files. The INSTANCES parameter helps ensure that the DataChannel applications that handle inventory and metrics perform the correct operation for a specific application pack. This is a read-only parameter whose value you cannot change. Typically, the value for INSTANCES is a string that represents the name of the application pack. 126 Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X

Appendix B: UBA Parameters Reference (Netcool/Proviso 443 and Higher) Custom Parameters As delivered, the NetFlow IPFIX Technology Pack includes Netcool/Proviso parameters that are mapped to NetFlow IPFIX Aurora properties. In addition to the parameters that are shipped with the technology pack and that are described in this reference, you can add custom parameters that you associate with additional Aurora properties. To add a custom parameter, follow these steps: 1. If it is not already open, open the Topology Editor. 2. Open the topology associated with the NetFlow IPFIX Technology Pack. 3. In the Technology Pack view, select the NetFlow IPFIX Technology Pack. 4. Display the COLLECTOR_UBA.x.x entry. The DataChannel core and pack-specific parameters display in the properties window. 5. Select the blue + (plus) icon that displays at the right top corner of the properties window. The Add Custom Property to Collector UBA wizard displays. 6. The wizard displays three fields: Name The NetFlow IPFIX Aurora property to associate with a NetFlow IPFIX sub-element. Specify the name in the following format: CISCO_NETFLOW.PROPERTIES.<aurora_property> In the format example, <aurora_property> is the name of the Aurora property to associate with a NetFlow IPFIX sub-element. For example: CISCO_NETFLOW.PROPERTIES.DESTIPNUMBER Note: Use all uppercase letters for the name of the Aurora property. Value The Netcool/Proviso parameter that is associated with the Aurora property specified in the Name field. To find the Netcool/Proviso parameter that is associated with a particular Aurora property, use the site configuration file. For example, the NetFlow IPFIX property DestIPNumber maps to the Netcool/Proviso parameter NF_DestIPAsNumber. Thus, specify NF_DestIPAsNumber in the Value field. Alias No value is required in this field. 7. Click Finish. Once the parameter is added, the Topology Editor marks it as a custom parameter in the last column of the properties window. For more information on the site configuration file, see Configuration By Means of Aurora Script on page 141. Note: Any new properties that you define must be attached to sub-elements and added to the Netcool/Proviso database. For more information, see Creating a New Property in the Netcool/Proviso DataMart Operation Guide. Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 127

Appendix B: UBA Parameters Reference (Netcool/Proviso 443 and Higher) Enabling Host reporting Host to Network reporting is extremely resource intensive, so it has been disabled by default. The number of subelements generated for Network to Host is as follows: number of destination IPs * number of applications * number of source networks The number of subelements generated for Host to Network is: number of source IPs * number of applications * number of destination networks. Follow these steps to enable host reporting: add NetHost and HostNet to the TOPIC_FILTER line in the dc.cfg file. This will prevent the UBA from filtering out those topics. Example: UBA.2.100.CISCO_NETFLOW.TOPIC_FILTER=Network,NetApp,AsNum,NetMatrix,NetToS,HostNet,NetHost Note: The above example of enabling host reporting, by modifying the dc.cfg file, is only relevant for NetCool/Proviso Pre-443. To enable host reporting for NetCool/Proviso 443 and higher, you must modify the value of the TOPIC_FILTER property, as detailed above, in the Topology Editor. 128 Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X

Appendix C: Template File Reference (Pre-443 Only) You should be reading this appendix after you have opened the cisco_netflow_sample_dc.cfg template file for editing, as instructed to do so in Appendix A, Configuration. Note: The cross reference link to Appendix A, Configuration does not work due to a formatting limitation. This appendix provides a UNIX reference page that identifies the pack-specific UBA parameters you need to add to the dc.cfg file and explains how to tailor the values to your specific deployment. Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 129

Appendix C: Template File Reference (Pre-443 Only) Pack-Specific UBA Parameters Template File Name cisco_netflow_sample_dc.cfg File Location The cisco_netflow_sample_dc.cfg template file resides in the following directory on the DataChannel server: DATA_CHANNEL_HOME/scripts (/opt/datachannel/scripts, by default) You were instructed to copy the cisco_netflow_sample_dc.cfg template file in a configuration step (Copy technology-specific files from the DataMart server to the DataChannel server) described in Appendix A, Configuration. Pack-Specific UBA Parameters The cisco_netflow_sample_dc.cfg template file provides the following pack-specific UBA parameters: UBA.<channel_number>.<collector_number>.DB_USERNAME=PV_INVENTORY UBA.<channel_number>.<collector_number>.COLLECTOR_ALIAS=100 UBA.<channel_number>.<collector_number>.COLLECTOR_LIST=100 UBA.<channel_number>.<collector_number>.DB_PASSWORD=CACC UBA.<channel_number>.<collector_number>.DISCOVERY_PERIOD_IN_HOURS=1 UBA.<channel_number>.<collector_number>.DUAL_LOGGING=false UBA.<channel_number>.<collector_number>.FC_FSLL=150000000 UBA.<channel_number>.<collector_number>.FC_QUOTA=1000000000 UBA.<channel_number>.<collector_number>.FC_RETENTION_HOURS=72 UBA.<channel_number>.<collector_number>.INSTANCES=<instance> UBA.<channel_number>.<collector_number>.LOG_FILTER=FEWI 123 UBA.<channel_number>.<collector_number>.MAX_LOGS=3 UBA.<channel_number>.<collector_number>.POLL_INTERVAL=60 UBA.<channel_number>.<collector_number>.RUNINTERVAL=60 UBA.<channel_number>.<collector_number>.ROOT_DIRECTORY=/opt/datachannel UBA.<channel_number>.<collector_number>.SERVICE_INSTANCE=GLOBAL UBA.<channel_number>.<collector_number>.TIMEZONE=GMT UBA.<channel_number>.<collector_number>.<instance>.DELETEONACQUIRE=true UBA.<channel_number>.<collector_number>.<instance>.DESIGNFILE=cisco_netflow/CiscoNetFlowAdaptor.js UBA.<channel_number>.<collector_number>.<instance>.CSV_DATA.URI=ftp://pvuser:CACC@LOCALHOST//var/lib/ aurora/sites/proviso/reports/report*.csv UBA.<channel_number>.<collector_number>.<instance>.CSV_DATA.DELETEONACQUIRE=true UBA.<channel_number>.<collector_number>.<instance>.APP.LOGGING=FALSE UBA.<channel_number>.<collector_number>.<instance>.APP.LEVEL=3 UBA.<channel_number>.<collector_number>.<instance>.TOPIC_FILTER=Network,NetApp,AsNum UBA.<channel_number>.<collector_number>.<instance>.PROPERTIES.Topic=NF_Topic UBA.<channel_number>.<collector_number>.<instance>.PROPERTIES.ip_router=NF_Router UBA.<channel_number>.<collector_number>.<instance>.PROPERTIES.protocol=NF_Protocol UBA.<channel_number>.<collector_number>.<instance>.PROPERTIES.Application=NF_Application UBA.<channel_number>.<collector_number>.<instance>.PROPERTIES.Tos=NF_Tos UBA.<channel_number>.<collector_number>.<instance>.PROPERTIES.domain=NF_NetworkName UBA.<channel_number>.<collector_number>.<instance>.PROPERTIES.asn_src=NF_SrcAsNum UBA.<channel_number>.<collector_number>.<instance>.PROPERTIES.asn_dst=NF_DstAsNum UBA.<channel_number>.<collector_number>.<instance>.PROPERTIES.port_src=NF_SourcePort UBA.<channel_number>.<collector_number>.<instance>.PROPERTIES.port_dst=NF_DestPort UBA.<channel_number>.<collector_number>.<instance>.PROPERTIES.SourceMask=NF_SourceMask 130 Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X

Appendix C: Template File Reference (Pre-443 Only) UBA.<channel_number>.<collector_number>.<instance>.PROPERTIES.DestMask=NF_DestMask UBA.<channel_number>.<collector_number>.<instance>.PROPERTIES.domain_src=NF_SourceNet UBA.<channel_number>.<collector_number>.<instance>.PROPERTIES.domain_dst=NF_DestNet UBA.<channel_number>.<collector_number>.<instance>.PROPERTIES.ip_nexthop=NF_NextHop UBA.<channel_number>.<collector_number>.<instance>.PROPERTIES.interface_in=NF_InputIFIndex UBA.<channel_number>.<collector_number>.<instance>.PROPERTIES.interface_out=NF_OutputIFIndex UBA.<channel_number>.<collector_number>.<instance>.PROPERTIES.tcp_lags=NF_TCPFlags UBA.<channel_number>.<collector_number>.<instance>.PROPERTIES.ip_src=NF_SourceIPAddress UBA.<channel_number>.<collector_number>.<instance>.PROPERTIES.ip_dst=NF_DestIPAddress UBA.<channel_number>.<collector_number>.<instance>.PROPERTIES.Site=NF_Site NetFlow IPFIX Properties in the Template File As delivered, the cisco_netflow_sample_dc.cfg template file includes configuration statements that define Aurora parameters as Netcool/Proviso properties. This allows the Aurora parameters defined in the site configuration file to be attached as properties to NetFlow IPFIX sub-elements. Each property definition statement in the cisco_netflow_sample_dc.cfg file uses the following format: UBA.<channel_number>.<collector_number>.<instance>.PROPERTIES.<aurora_parameter>=<proviso_property> Where <aurora_parameter>=<proviso_property> represent the Aurora parameters and Netcool/Proviso properties listed in the site configuration file. To include additional properties, add a new property statement using the format above for each property being created. For more information on the site configuration file, see Configuration By Means of Aurora Script on page 141. Note: Any new properties defined in the dc.cfg file must be attached to sub-elements and added to the Netcool/Proviso database. For more information, see Creating a New Property in the Netcool/Proviso DataMart Operation Guide. NetFlow IPFIX Topics in the Template File As delivered, the cisco_netflow_sample_dc.cfg template file includes a configuration statement that defines the NetFlow IPFIX Topics that are collected and processed by Netcool/Proviso. This allows Topics defined in the site configuration file to be created as NetFlow IPFIX sub-elements. The topic filtering statement in the cisco_netflow_sample_dc.cfg file uses the following format: UBA.<channel_number>.<collector_number>.<instance>.TOPIC_FILTER=<topic1>,<topic2>,...<topicN> Where <topic1>,<topic2>,...<topicn> are NetFlow IPFIX Topics defined in the site configuration file. To include another topic, add its name of the list of filtered topics in the TOPIC_FILTER statement. For more information on the site configuration file, see Configuration By Means of Aurora Script on page 141. Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 131

Appendix C: Template File Reference (Pre-443 Only) Pack-Specific UBA Parameter Values UBA Parameter Value <channel_number> <collector_number> <instance> <input_files_location> Meaning Replace with the channel number that was configured for this technology pack. This channel number appears in the dc.cfg file. Replace with the UBA Bulk Collector number that was configured for this technology pack. This collector number appears in the dc.cfg file. Replace the variable with an arbitrary string (for example, LOWELL) that identifies a group alias to be associated with subsequent lines in this section of the dc.cfg file. See Additional Information on UBA Parameter Values on page 132 for more information on this UBA parameter value. Replace the variable with the ftp or file path that identifies the location of the Bulk input files that the device generates. See Additional Information on UBA Parameter Values on page 132 for more information on this UBA parameter value. Additional Information on UBA Parameter Values <instance> The DataChannel UBA application supports multiple instances of technology packs running in a single channel component. Therefore, there must be a way to guarantee that the UBA parses the correct design file and reads the appropriate Bulk input files. The INSTANCES parameter helps ensure that the DataChannel UBA application performs the correct operation for a specific technology pack. The NetFlow IPFIX Technology Pack provides an INSTANCES parameter in its cisco_netflow_sample_dc.cfg template file. You supply an arbitrary string referred to as a group alias to the INSTANCES parameter. After you define the INSTANCES parameter with a specific string, make sure you specify this string wherever <instance> appears in the template file. You can associate this group alias with any arbitrary string. For example, you might associate this group alias with the location (for example, BOSTON, LOWELL, BERLIN, PARIS, and so forth) of the data source. <input_files_location> The DataChannel UBA application needs to know where to find the Bulk input files that the supported device generates. Therefore, you must specify a Universal Resource Identifier (URI) for the location of the Bulk input files. To define this location, the NetFlow IPFIX Technology Pack provides a URI parameter in its cisco_netflow_sample_dc.cfg template file. Follow these guidelines when specifying a URI in the template or dc.cfg file: Use Internet-standard URIs. Specify the file protocol, FTP (File Transfer Protocol), or SFTP (secure FTP). The file protocol is appropriate only when specifying a path on the same host computer. When using the file protocol, specify a full absolute path after the initial file://. This results in three slashes after the word file, because the full path must begin with a slash. When using FTP or SFTP, use the following syntax: ftp://<username>:<encrypted_password>@<hostname>//full/path/to/directory/specific_string sftp://<username>:<encrypted_password>@<hostname>//full/path/to/directory/specific_string where: 132 Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X

Appendix C: Template File Reference (Pre-443 Only) <username> Specifies the username that the server administrator assigned (using the ftp or sftp utility) to the FTP or SFTP user. The FTP or SFTP user specifies this username to gain access to the server on which the technology pack is installed. <encrypted_password> Specifies the password that the server administrator assigned (using the ftp or sftp utility) to the FTP or SFTP user. The FTP or SFTP user specifies this password to gain access to the server on which the technology pack is installed. The password specified here should be the encrypted password. <hostname> Specifies the hostname of the server on which the Bulk input files reside. These are the files that the UBA parses. specific_string Refers to the string that ends an entry for the URI line. To use the sftp command, you must have an SSH client installed on the servers where the Bulk input files reside and where the DataChannel is running. Typically, an SSH client is installed by default on most UNIX systems. For more information, see your operating system documentation or the sftp manpage. NOTE: You cannot do the following: Use an FTP client to connect to an SFTP server Connect to an FTP server with a client that supports only SFTP Notes Use the following guidelines to determine if you have the correct value for the UBA.<channel_number>.<collector_number>.DB_USERNAME parameter in the dc.cfg file: The UBA technology pack requires the DataChannel UBA application to process metrics only. In this scenario, the UBA technology pack provides a metrics schema in its design file. In this case, DB_USERNAME must be set to PV_COLL. The UBA technology pack requires the DataChannel UBA application to process both inventory and metrics. In this scenario, the UBA technology pack provides metrics and inventory schemas in its design file. In this case, DB_USERNAME must be set to PV_GUI. For the NetFlow IPFIX Technology Pack, DB_USERNAME should be set to PV_GUI. Examples The following example shows pack-specific UBA parameter settings. Example: UBA.2.100.CISCO_NETFLOW.APP.LEVEL=3 UBA.2.100.CISCO_NETFLOW.APP.LOGGING=FALSE UBA.2.100.CISCO_NETFLOW.CSV_DATA.DELETEONACQUIRE=TRUE UBA.2.100.CISCO_NETFLOW.CSV_DATA.URI=ftp://pvuser:CACC@LOCALHOST//var/lib/aurora/sites /proviso/reports/report*.csv UBA.2.100.CISCO_NETFLOW.DESIGNFILE=cisco_netflow/CiscoNetFlowAdaptor.js UBA.2.100.CISCO_NETFLOW.PROPERTIES.application=NF_Application UBA.2.100.CISCO_NETFLOW.PROPERTIES.ip_dst=NF_DestIPAddress UBA.2.100.CISCO_NETFLOW.PROPERTIES.DestMask=NF_DestMask UBA.2.100.CISCO_NETFLOW.PROPERTIES.domain_dst=NF_DestNet UBA.2.100.CISCO_NETFLOW.PROPERTIES.port_dst=NF_DestPort UBA.2.100.CISCO_NETFLOW.PROPERTIES.asn_dst=NF_DstAsNum UBA.2.100.CISCO_NETFLOW.PROPERTIES.interface_in=NF_InputIFIndex UBA.2.100.CISCO_NETFLOW.PROPERTIES.domain=NF_NetworkName UBA.2.100.CISCO_NETFLOW.PROPERTIES.ip_nexthop=NF_NextHop Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 133

Appendix C: Template File Reference (Pre-443 Only) UBA.2.100.CISCO_NETFLOW.PROPERTIES.interface_out=NF_OutputIFIndex UBA.2.100.CISCO_NETFLOW.PROPERTIES.protocol=NF_Protocol UBA.2.100.CISCO_NETFLOW.PROPERTIES.ip_router=NF_Router UBA.2.100.CISCO_NETFLOW.PROPERTIES.ip_src=NF_SourceIPAddress UBA.2.100.CISCO_NETFLOW.PROPERTIES.SourceMask=NF_SourceMask UBA.2.100.CISCO_NETFLOW.PROPERTIES.domain_src=NF_SourceNet UBA.2.100.CISCO_NETFLOW.PROPERTIES.port_src=NF_SourcePort UBA.2.100.CISCO_NETFLOW.PROPERTIES.asn_src=NF_SrcAsNum UBA.2.100.CISCO_NETFLOW.PROPERTIES.tcp_flags=NF_TCPFlags UBA.2.100.CISCO_NETFLOW.PROPERTIES.Topic=NF_Topic UBA.2.100.CISCO_NETFLOW.PROPERTIES.tos=NF_Tos UBA.2.100.CISCO_NETFLOW.PROPERTIES.Site=NF_Site UBA.2.100.CISCO_NETFLOW.TOPIC_FILTER=Network,NetApp,AsNum,NetMatrix,NetToS UBA.2.100.COLLECTOR_ALIAS=100 UBA.2.100.COLLECTOR_LIST=100 UBA.2.100.DB_PASSWORD=CACC UBA.2.100.DB_USERNAME=PV_INVENTORY UBA.2.100.DUAL_LOGGING=FALSE UBA.2.100.FC_FSLL=150000000 UBA.2.100.FC_QUOTA=100000000 UBA.2.100.FC_RETENTION_HOURS=72 UBA.2.100.INSTANCES=CISCO_NETFLOW UBA.2.100.LOG_FILTER=FEWI 123 UBA.2.100.MAX_LOGS=3 UBA.2.100.POLL_INTERVAL=60 UBA.2.100.ROOT_DIRECTORY=/opt/datachannel UBA.2.100.RUNINTERVAL=60 UBA.2.100.SERVICE_INSTANCE=GLOBAL UBA.2.100.TIMEZONE=GMT 134 Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X

Appendix D: Aurora Netflow Collector Installation and Configuration This appendix discusses the following topics: Topic Page Overview 135 Deployment Considerations 135 Aurora Installation 137 Aurora Configuration 138 Overview This appendix describes how to install, configure, and run the Aurora Netflow Collector that is used to obtain and process Netflow datagrams. Deployment Considerations Topology In high volume environments, the Aurora Netflow Collector can be installed on multiple machines using a oneto-one relationship between a Aurora Netflow Collector and the technology pack. For example, in a deployment of 500 routers, five instances of the technology pack/aurora Netflow Collector combination can be used to each monitor 100 routers. Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 135

Appendix D: Aurora Netflow Collector Installation and Configuration Duplication The Aurora Netflow Collector will not prevent packets passing through two NetFlow-enabled interfaces from being counted twice. To avoid this, configure your network so that duplication never occurs, for example, by enabling NetFlow export on edge interfaces only. The following diagram depicts such a configuration: N N N N N = edge interface Scalability Deployment of this technology pack can be scaled to meet local requirements by adding additional installations of the technology pack and Aurora Netflow Collector where required. Netcool/Proviso is optimized to keep track of devices and their characteristics for a very long time. To use this modeling scheme to keep track of IP addresses (whose information and characteristics are not useful for more than a few hours or days) would be extremely resource-intensive. The Network-host and Host-Network reports do this, but because they are extremely resource-intensive, it has been disabled by default during the installation process. If you choose to enable these report sets, you should only use them in a small environment with a limited number of hosts. 136 Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X

Appendix D: Aurora Netflow Collector Installation and Aurora Installation Install the Aurora Netflow Collector after installing the NetFlow IPFIX Technology Pack, but before performing the pack configuration steps described in Appendix A. Aurora uses the RPM (Redhat RHEL, Suse SLES) and DEB (Debian) installation mechanisms. The following sections show the specific commands for these mechanisms. Version, release and architecture specifications might vary between distributions. Note: The NetFlow IPFIX Technology Pack stores the Aurora install packages in $PVMHOME/APFiles/cisco_netflow/adaptor Solaris Log on as a user with root administration rights. Install Aurora on Solaris platforms using the following commands: #> gunzip aurora-4.0.4-sol9-sparc.tar.gz #> tar xf aurora-4.0.4-sol9-sparc.tar #> cd aurora #>./INSTALL The installation directories are /opt/aurora, /var/lib/aurora and /etc/aurora. Files are written into /etc/init.d. Note: The example above is for Solaris 9. For Solaris 10 the files aurora-4.0.4-sol10- sparc.tar.gz and aurora-4.0.4-sol10-sparc.tar are required. RPM Installation (RHEL, SLES) Log on as a user with root administration rights. Install Aurora on RHEL and SLES platforms using the following command: #> rpm -Uhv aurora-4.0.4-sol9.i386.rpm The installation directories are /opt/aurora, /var/lib/aurora and /etc/aurora. Files are written to /etc/rc.d, as well as to /var/www/html and /var/www/cgi-bin for RHEL and /srv/www/cgi-bin and /srv/www/htdocs for SLES. DEB Installation (Debian) Log on as a user with root administration rights. Install Aurora on Debian platforms using the following command: #> dpkg -i aurora-3.6-2008.03.18.i386.deb The installation directories are /opt/aurora, /var/lib/aurora and /etc/aurora. Files are written to /etc/rc.d, /usr/lib/cgi-bin and /var/www. License File Aurora for Proviso is distributed without a license check. Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 137

Appendix D: Aurora Netflow Collector Installation and Configuration Pre-Configuration Pre-configured aspects are NetMatrix, NetApp, Network, NetToS and AsNum. Note that these aspect names are (and must be) the same as the values provided for CISCO_NETFLOW.TOPIC_FILTER in the Topology Editor. The aspect FlowState is also pre-configured but not used. All aspect configuration is done in /opt/aurora/var/sites/proviso/etc/site.conf. /etc/aurora/site_proviso.conf is a link to this. NetHost tva_counter exporter_ip domain_src ip_dst application HostNet tva_counter exporter_ip ip_src domain_dst application Default System Users The following table shows default system users for running Aurora on different platforms. Platform Solaris Linux Default system user:group pvuser:staff aurora:aurora During the installation, the default system user and group is added to the operating system if it does not exist yet. Installation files and variable data files are owned by the Aurora system user. Aurora Configuration Aurora uses the main configuration file /etc/aurora/aurora.conf, which contains settings valid for all sites. The receiving port is configured here. The simulations and previous versions of the NetFlow IPFIX pack use UDP port 9996, so it is recommended that you change or add to the below flow_url "udp://any:9996" : ### ----------------------------------------------------------------------- ### Collector port numbers (NetFlow: 2055/UDP and IPFIX: 4739/SCTP) ### ----------------------------------------------------------------------- flow_url udp://any:2055 #flow_url udp://any:2055 any://any:4739 udp://any:9005 Site-specific configuration issues are maintained in individual site configuration files, for example /etc/aurora/site_proviso.conf, for the default Proviso site. The most important configuration options are: ### ----------------------------------------------------------------------- ### NetFlow/IPFIX accepted from these exporters (for ports see aurora.conf) ### ----------------------------------------------------------------------- set routers 0.0.0.0/0 #set routers 127.0.0.1/8 10.10.10.0/24 ### --------------------------------------------------------------- ### Create custom aspects 138 Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X

Appendix D: Aurora Netflow Collector Installation and ### --------------------------------------------------------------- aspect new NetworkHost counter multiple ip_router domain_src ip_dst application new NetworkMatrix counter multiple ip_router domain_src domain_dst application new NetApp counter multiple ip_router domain_src protocol application tos new Network counter multiple ip_router domain new AsNum counter multiple ip_router asn_src asn_dst new NetHost tva_counter exporter_ip domain_src ip_dst application set name "Src Network - Dst Host" new HostNet tva_counter exporter_ip ip_src domain_dst application set name "Src Host - Dst Network" end ### --------------------------------------------------------------- ### Domain reporting (domain id: 0 < ID < 2048) ### --------------------------------------------------------------- domain # Gloabal domain reporting set aspects AsNum Network NetApp NetworkMatrix NetworkHost set periods hour # Private Address Space (RFC1918 + RFC4193) new 1 "Private" set local yes set subnet 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 fc00::/7 # Link Local Address Space (RFC3330 + RFC3513) new 2 "Link Local" set local yes set subnet 169.254.0.0/16 fe80::/10 # Documentation Address Space (RFC3330 + RFC3849) new 3 "Documentation" set local yes set subnet 192.0.2.0/24 2001:db8::/32 # Domain definiton with autonomous system number new 4 "Swisscom" set flag /aurora/flags/ch.gif set asn 3303 Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 139

Appendix D: Aurora Netflow Collector Installation and Configuration # Domain definiton with autonomous system number new 5 "DTAG" set flag /aurora/flags/de.gif set asn 3320 select NetHost octets set itemsmax 200000 set itemslim 400000 set periods hour select NetHost packets set itemsmax 200000 set itemslim 400000 set periods hour select HostNet octets set itemsmax 200000 set itemslim 400000 set periods hour end select HostNet packets set itemsmax 200000 set itemslim 400000 set periods hour ### ----------------------------------------------------------------------- ### Compress (ZIP=bzip2) or delete (ZIP=REMOVE) flow file after... ### Day = 86400s ### Month = 2592000s ### Never = 0s ### ----------------------------------------------------------------------- set flowflushcommand REMOVE set flowflushperiod 86400 ### ----------------------------------------------------------------------- ### Size of NetFlow/IPFIX receive buffer (10MB min and 100MB max) ### ----------------------------------------------------------------------- set flowbuffersize 100 140 Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X

Appendix D: Aurora Netflow Collector Installation and ### ----------------------------------------------------------------------- ### Enable/Disable DNS reverse lookup ### ----------------------------------------------------------------------- set dnsresolving yes Aurora can be customized with respect to the grouping of TCP/UDP ports into applications and naming of protocols, autonomous systems, services, interfaces, traffic service classes (for example, quality-of-service types). The configuration files are: /etc/aurora/protocols /etc/aurora/services /etc/aurora/applications /etc/aurora/tos /etc/aurora/icmp /etc/aurora/asn /etc/aurora/interfaces Sites are used to separate traffic information between administrative domains. A single Aurora installation can be used for many administrative domains with potentially overlapping (private) address spaces and individual configurations. A separate database is maintained for every site. It is recommended to start an installation with a single default site. The default site in the Proviso installation is named Proviso. Certain router interfaces can be explicitly excluded, for example, to avoid duplicate NetFlow reporting. Configuration By Means of Aurora Script Use a script called aurora to start and stop the Aurora engine, as well as to add, remove, or list topics and aspects. This script automatically updates the report_site.ash when it is used to add topics. Usage: aurora OPTIONS The following table shows possible values for OPTIONS. Option start [verbose confirm] restart [verbose] stop [verbose confirm] reset [<site_name>] showsites addsite [<site>] delsite [<site>] showaspects [<site>] Start Restart Stop Reset interactively Show all sites Add new site Delete site Show all aspects Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 141

Appendix D: Aurora Netflow Collector Installation and Configuration Option showaspectcomponents addaspect [<site> [<aspect>]] delaspect [<site> [<aspect>]] showusers showuser [<id>] adduser [<id>] deluser [<id>] status [mail sms tec] deinstall version help Show all valid aspect components Add new user-defined aspect Delete user-defined aspect Show all user accounts Show single user account Add new user account Delete user account Show runtime status Deinstall the system Version Help User-Defined Aspects Aurora provides a list of basic aspects and makes it possible to define new composed aspects. The basic aspects are: <basic aspect> := host port tos domain direction type proto appl flow interface asn icmp User-defined aspects are defined in the individual site configuration files, for example /etc/aurora/site_proviso.conf for the default Proviso site. <user-defined aspect> := aspect new <aspect name> counter multiple <component>+ The parameter counter means that only total counters are stored in the database. The parameter multiple means that multiple units are recorded in the database, for example, in/out octets, in/out packets and in/out flows. For configuration with Netcool/Proviso, user-defined aspects should always use counter and multiple. The components of a user-defined aspect can be: <component>:= domain domain_src domain_dst direction ip ip_src ip_dst ip_nexthop ip_version ip_router ip_router_port interface interface_in interface_out port port_src port_dst protocol service application as as_src as_dst type tos tcp_flags flowlabel 142 Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X

Appendix D: Aurora Netflow Collector Installation and icmp flow_version duration packets octets Following are four examples of user-defined aspects: aspect new MyTopic1 counter multiple ip_router domain protocol application tos aspect new MyTopic2 counter multiple asn_dst ip_dst aspect new MyTopic3 counter multiple application ip_src ip_dst aspect new MyTopic4 counter multiple ip ip_version Following are aspect definitions for AS Matrix and Protocol/Port Matrix aggregations: aspect new ASPortMatrix counter multiple as_src as_dst interface_in interface_out aspect new ProtocolPortMatrix counter multiple protocol port_src port_dst Adding Networks and Domains Configure network and domain names by editing the site configuration file. The following shows an example of a domain definition. domain # Global domain reporting set aspects AsNum Network NetApp NetworkMatrix set periods hour # Private Address Space (RFC1918 + RFC4193) new 1 "Private" set local yes set subnet 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 fc00::/7 # Link Local Address Space (RFC3330 + RFC3513) new 2 "Link Local" set local yes set subnet 169.254.0.0/16 fe80::/10 # Documentation Address Space (RFC3330 + RFC3849) new 3 "Documentation" set local yes set subnet 192.0.2.0/24 2001:db8::/32 # Domain definiton with autonomous system number new 4 "Swisscom" set flag /aurora/flags/ch.gif set asn 3303 # Domain definiton with autonomous system number new 5 "DTAG" set flag /aurora/flags/de.gif Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 143

Appendix D: Aurora Netflow Collector Installation and Configuration end set asn 3320 Starting and Stopping Aurora Use the following commands to start and stop the Aurora Netflow Collector. To... start Aurora stop Aurora see Aurora s current status Command aurora start aurora stop aurora status Aurora Configuration and Load Balancing The normal load balancing mechanism performs well when there are a lot of Netflow-enabled routers sending data to the same database. In these conditions, you can configure multiple Aurora/UBA instances to balance the load. This approach to load balancing is not helped if one large router can generate enough flow data to overload a single Aurora/UBA instance by itself. To deal with this situation the following modifications to the Aurora configuration are required: aurora_split_report.pl This file is delivered in <DATACHANNEL_HOME>/APFiles/cisco_netflow/adaptor and should be copied to /opt/aurora/bin. As delivered, it is set up to split the Aurora output on the basis of the input interface (line 15, my $split_key = in ; ). If the router is configured to collect flows from the output side of its interfaces, change this to out. /etc/aurora/site_proviso.conf In the aspect section, change the Topic definitions by adding interface_in interface_out at the end of each, as follows: new NetMatrix tva_counter exporter_ip domain_src domain_dst application interface_in interface_out Do this for all Topic definitions, with the exception of FlowState which is not used. 144 Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X

Appendix D: Aurora Netflow Collector Installation and /opt/aurora/var/sites/proviso/etc Add interface_in=%flow:interface_in#name%,interface_out=%flow:interface_ out#name%, between the SE and UE markers, as follows (this is all on the same ine): site aspect printf "Source=Aurora,Site=proviso,Topic=NetMatrix,Timestamp=$date$,SE,ip_router= %flow:exporter_ip%,interface_in=%flow:interface_in#name%,interface_out= %flow:interface_out#name%,domain_src=%flow:domain_src#name%,domain_dst= %flow:domain_dst#name%,application=%flow:application#name%,ue,packetsout= $packets_sent$,bytesout=$bytes_sent$,packetsin=$packets_recv$,bytesin= $bytes_recv$\n" @@keys:$i$@@ Do this for all Topic definitions, with the exception of FlowState which is not used. Restart Aurora. Aurora will continue to put all its output (.csv) files in /opt/aurora/var/sites/proviso/reports but it will also create two directories in reports called 0 and 1. Change your existing UBA to take its input from reports/0 and configure a second UBA to take input from reports/1 Both UBAs should direct output to the same CME. Stop and restart the channel. Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 145

Appendix D: Aurora Netflow Collector Installation and Configuration NOTES 146 Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X

Additional Copyright Information The following copyright information is for software used by Netcool/Proviso. Tcl 8.3.3, Combat/TCL 0.7.3, Combat/TCL 0.7.5, TclX 8.3, TK 8.3.3 This software is copyrighted by the Regents of the University of California, Sun Microsystems, Inc., Scriptics Corporation, and other parties. The following terms apply to all files associated with the software unless explicitly disclaimed in individual files. The authors hereby grant permission to use, copy, modify, distribute, and license this software and its documentation for any purpose, provided that existing copyright notices are retained in all copies and that this notice is included verbatim in any distributions. No written agreement, license, or royalty fee is required for any of the authorized uses. Modifications to this software may be copyrighted by their authors and need not follow the licensing terms described here, provided that the new terms are clearly indicated on the first page of each file where they apply. IN NO EVENT SHALL THE AUTHORS OR DISTRIBUTORS BE LIABLE TO ANY PARTY FOR DIRECT, INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OF THIS SOFTWARE, ITS DOCUMENTATION, OR ANY DERIVATIVES THEREOF, EVEN IF THE AUTHORS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. THE AUTHORS AND DISTRIBUTORS SPECIFICALLY DISCLAIM ANY WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. THIS SOFTWARE IS PROVIDED ON AN "AS IS" BASIS, AND THE AUTHORS AND DISTRIBUTORS HAVE NO OBLIGATION TO PROVIDE MAINTENANCE, SUPPORT, UPDATES, ENHANCEMENTS, OR MODIFICATIONS. GOVERNMENT USE: If you are acquiring this software on behalf of the U.S. government, the Government shall have only "Restricted Rights" in the software and related documentation as defined in the Federal Acquisition Regulations (FARs) in Clause 52.227.19 (c) (2). If you are acquiring the software on behalf of the Department of Defense, the software shall be classified as "Commercial Computer Software" and the Government shall have only "Restricted Rights" as defined in Clause 252.227-7013 (c) (1) of DFARs. Notwithstanding the foregoing, the authors grant the U.S. Government and others acting in its behalf permission to use and distribute the software in accordance with the terms specified in this license. SCOTTY Stack This software is copyrighted by Juergen Schoenwaelder, the Technical University of Braunschweig, the University of Twente, and other parties. The following terms apply to all files associated with the software unless explicitly disclaimed in individual files. The authors hereby grant permission to use, copy, modify, distribute, and license this software and its documentation for any purpose, provided that existing copyright notices are retained in all copies and that this notice is included verbatim in any distributions. No written agreement, license, or royalty fee is required for any of the authorized uses. Modifications to this software may be copyrighted by their authors and need not follow the licensing terms described here, provided that the new terms are clearly indicated on the first page of each file where they apply. IN NO EVENT SHALL THE AUTHORS OR DISTRIBUTORS BE LIABLE TO ANY PARTY FOR DIRECT, INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OF THIS SOFTWARE, ITS DOCUMENTATION, OR ANY DERIVATIVES THEREOF, EVEN IF THE AUTHORS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. THE AUTHORS AND DISTRIBUTORS SPECIFICALLY DISCLAIM ANY WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. THIS SOFTWARE IS PROVIDED ON AN AS IS BASIS, AND THE AUTHORS AND Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 147

Additional Copyright information DISTRIBUTORS HAVE NO OBLIGATION TO PROVIDE MAINTENANCE, SUPPORT, UPDATES, ENHANCEMENTS, OR MODIFICATIONS. Various copyrights apply to this package, listed in 3 separate parts below. Please make sure that you include all the parts. Up until 2001, the project was based at UC Davis, and the first part covers all code written during this time. From 2001 onwards, the project has been based at SourceForge, and Networks Associates Technology, Inc hold the copyright on behalf of the wider Net-SNMP community, covering all derivative work done since then. An additional copyright section has been added as Part 3 below also under a BSD license for the work contributed by Cambridge Broadband Ltd. to the project since 2001. Part 1: CMU/UCD copyright notice: (BSD like) Copyright 1989, 1991, 1992 by Carnegie Mellon University Derivative Work - 1996, 1998-2000 Copyright 1996, 1998-2000 The Regents of the University of California All Rights Reserved Permission to use, copy, modify and distribute this software and its documentation for any purpose and without fee is hereby granted, provided that the above copyright notice appears in all copies and that both that copyright notice and this permission notice appear in supporting documentation, and that the name of CMU and The Regents of the University of California not be used in advertising or publicity pertaining to distribution of the software without specific written permission. CMU AND THE REGENTS OF THE UNIVERSITY OF CALIFORNIA DISCLAIM ALL WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL CMU OR THE REGENTS OF THE UNIVERSITY OF CALIFORNIA BE LIABLE FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM THE LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. Part 2: Networks Associates Technology, Inc copyright notice (BSD) Copyright 2001, Networks Associates Technology, Inc All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. Neither the name of the NAI Labs nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS AS IS AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. Part 3: Cambridge Broadband Ltd. copyright notice (BSD) Portions of this code are copyright 2001, Cambridge Broadband Ltd. All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. 148 Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X

Additional Copyright information Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. The name of Cambridge Broadband Ltd. may not be used to endorse or promote products derived from this software without specific prior written permission. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDER AS IS AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. BLT 2.4u Portions (c) 1993 AT&T, (c) 1993-1998 Lucent Technologies, (c) 1994-1998 Sun Microsystems, Inc., and (c) 1987-1993 The Regents of the University of California. Permission to use, copy, modify and distribute this software and its documentation for any purpose and without fee is hereby granted, provided that the above copyright notice appears in all copies and that both that copyright notice and this permission notice appear in supporting documentation, and that the names of AT&T, Lucent Technologies Inc., Sun Microsystems, Inc. and The Regents of the University of California not be used in advertising or publicity pertaining to distribution of the software without specific written permission. THE COPYRIGHT HOLDERS AND OTHER CONTRIBUTORS DISCLAIM ALL WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE COPYRIGHT HOLDERS OR OTHER CONTRIBUTORS BE LIABLE FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM THE LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. CMU-SNMP 1.14 CMU/UCD copyright notice: (BSD like) Copyright 1989, 1991, 1992 by Carnegie Mellon University Derivative Work - 1996, 1998-2000 Copyright 1996, 1998-2000 The Regents of the University of California All Rights Reserved Permission to use, copy, modify and distribute this software and its documentation for any purpose and without fee is hereby granted, provided that the above copyright notice appears in all copies and that both that copyright notice and this permission notice appear in supporting documentation, and that the name of CMU and The Regents of the University of California not be used in advertising or publicity pertaining to distribution of the software without specific written permission. CMU AND THE REGENTS OF THE UNIVERSITY OF CALIFORNIA DISCLAIM ALL WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL CMU OR THE REGENTS OF THE UNIVERSITY OF CALIFORNIA BE LIABLE FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM THE LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. Scotty 2.8, incrtcl 3.0, [incr TCL] 3.2 Portions Copyright (c) 1987-1994 The Regents of the University of California. Copyright (c) 1994-1995 Sun Microsystems, Inc. Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 149

Additional Copyright information This software is copyrighted by the Regents of the University of California, Sun Microsystems, Inc., and other parties. The following terms apply to all files associated with the software unless explicitly disclaimed in individual files. The authors hereby grant permission to use, copy, modify, distribute, and license this software and its documentation for any purpose, provided that existing copyright notices are retained in all copies and that this notice is included verbatim in any distributions. No written agreement, license, or royalty fee is required for any of the authorized uses. Modifications to this software may be copyrighted by their authors and need not follow the licensing terms described here, provided that the new terms are clearly indicated on the first page of each file where they apply. IN NO EVENT SHALL THE AUTHORS OR DISTRIBUTORS BE LIABLE TO ANY PARTY FOR DIRECT, INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OF THIS SOFTWARE, ITS DOCUMENTATION, OR ANY DERIVATIVES THEREOF, EVEN IF THE AUTHORS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. THE AUTHORS AND DISTRIBUTORS SPECIFICALLY DISCLAIM ANY WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. THIS SOFTWARE IS PROVIDED ON AN "AS IS" BASIS, AND THE AUTHORS AND DISTRIBUTORS HAVE NO OBLIGATION TO PROVIDE MAINTENANCE, SUPPORT, UPDATES, ENHANCEMENTS, OR MODIFICATIONS. RESTRICTED RIGHTS: Use, duplication or disclosure by the government is subject to the restrictions as set forth in subparagraph (c) (1) (ii) of the Rights in Technical Data and Computer Software Clause as DFARS 252.227-7013 and FAR 52.227-19. Portions Copyright (c) 1993-1998 Lucent Technologies, Inc. Permission to use, copy, modify, and distribute this software and its documentation for any purpose and without fee is hereby granted, provided that the above copyright notice appear in all copies and that both that the copyright notice and warranty disclaimer appear in supporting documentation, and that the names of Lucent Technologies any of their entities not be used in advertising or publicity pertaining to distribution of the software without specific, written prior permission. Lucent disclaims all warranties with regard to this software, including all implied warranties of merchantability and fitness. In no event shall Lucent be liable for any special, indirect or consequential damages or any damages whatsoever resulting from loss of use, data or profits, whether in an action of contract, negligence or other tortuous action, arising out of or in connection with the use or performance of this software. UCD SNMP 4.2.5 Portions Copyright 1989, 1991, 1992 by Carnegie Mellon University. Derivative Work - 1996, 1998-2000, Copyright 1996, 1998-2000 The Regents of the University of California All Rights Reserved Permission to use, copy, modify and distribute this software and its documentation for any purpose and without fee is hereby granted, provided that the above copyright notice appears in all copies and that both that copyright notice and this permission notice appear in supporting documentation, and that the name of CMU and The Regents of the University of California not be used in advertising or publicity pertaining to distribution of the software without specific written permission. CMU AND THE REGENTS OF THE UNIVERSITY OF CALIFORNIA DISCLAIM ALL WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL CMU OR THE REGENTS OF THE UNIVERSITY OF CALIFORNIA BE LIABLE FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM THE LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. Portions Copyright: (c) 2001-2003, Networks Associates Technology, Inc, (c) 2001-2003, Cambridge Broadband Ltd, (c) 2003-2005, Sparta, Inc., (c) 2004, Cisco, Inc and Information Network Center of Beijing University of Posts and Telecommunications, (c) Fabasoft R&D Software GmbH & Co KG, 2003 oss@fabasoft.com. All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. 150 Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X

Additional Copyright information 3. Neither the names of Networks Associates Technology, Inc, Cambridge Broadband Ltd., Sparta, Inc., Cisco, Inc, Beijing University of Posts and Telecommunications, Fabasoft R&D Software GmbH & Co KG or any of its subsidiaries, brand or product names, nor the names of their contributors may be used to endorse or promote products derived from this software without specific prior written permission. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. JDOM 1.0 Copyright (C) 2000-2004 Jason Hunter & Brett McLaughlin. All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: 1. Redistributions of source code must retain the above copyright notice, this list of conditions, and the following disclaimer. 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions, and the disclaimer that follows these conditions in the documentation and/or other materials provided with the distribution. 3. The name "JDOM" must not be used to endorse or promote products derived from this software without prior written permission. For written permission, please contact <request_at_jdom_dot_org>. 4. Products derived from this software may not be called "JDOM", nor may "JDOM" appear in their name, without prior written permission from the JDOM Project Management <request_at_jdom_dot_org>. In addition, we request (but do not require) that you include in the end-user documentation provided with the redistribution and/or in the software itself an acknowledgement equivalent to the following: "This product includes software developed by the JDOM Project (http://www.jdom.org/)." Alternatively, the acknowledgment may be graphical using the logos available at http://www.jdom.org/images/logos. THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE JDOM AUTHORS OR THE PROJECT CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. This software consists of voluntary contributions made by many individuals on behalf of the JDOM Project and was originally created by Jason Hunter <jhunter_at_jdom_dot_org> and Brett McLaughlin <brett_at_jdom_dot_org>. For more information on the JDOM Project, please see <http://www.jdom.org/>. Regex 1.1a Copyright (C) 1996, 1999 Vassili Bykov. It is provided to the Smalltalk community in hope it will be useful. 1. This license applies to the package as a whole, as well as to any component of it. By performing any of the activities described below, you accept the terms of this agreement. 2. The software is provided free of charge, and ``as is'', in hope that it will be useful, with ABSOLUTELY NO WARRANTY. The entire risk and all responsibility for the use of the software is with you. Under no circumstances the author may be held responsible Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X 151

Additional Copyright information for loss of data, loss of profit, or any other damage resulting directly or indirectly from the use of the software, even if the damage is caused by defects in the software. 3. You may use this software in any applications you build. 4. You may distribute this software provided that the software documentation and copyright notices are included and intact. 5. You may create and distribute modified versions of the software, such as ports to other Smalltalk dialects or derived work, provided that: a. any modified version is expressly marked as such and is not misrepresented as the original software; b. credit is given to the original software in the source code and documentation of the derived work; c. the copyright notice at the top of this document accompanies copyright notices of any modified version. Xwpick Copyright 1993, 1994 by Evgeni Chernyaev Permission to use, copy, modify, and distribute this software and its documentation for non-commercial purpose is hereby granted without fee, provided that the above copyright notice appear in all copies and that both the copyright notice and this permission notice appear in supporting documentation. Xwpick is used for printing utilities. Sieve of Erastothenes Copyright Frank Pilhofer, fp@fpx.de Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. Neither the name of Frank Pilhofer nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 152 Netcool/Proviso NetFlow IPFIX 2.4.1.0 Technology Pack User s Guide, Version 4.3-X