Applies To:

Show Versions Show Versions

Manual Chapter: Monitoring BIG-IP System Traffic with sFlow
Manual Chapter
Table of Contents   |   << Previous Chapter   |   Next Chapter >>

Overview: Configuring network monitoring with sFlow

sFlow is an industry-standard technology for monitoring high-speed switched networks. You can configure the BIG-IP® system to poll internal data sources and send data samples to an sFlow receiver. You can then use the collected data to analyze the traffic that traverses the BIG-IP system. This analysis can help you understand traffic patterns and system usage for capacity planning and charge back, troubleshoot network and application issues, and evaluate the effectiveness of your security policies.

Adding a performance monitoring sFlow receiver

Gather the IP addresses of the sFlow receivers that you want to add to the BIG-IP® system configuration. You can use IPv4 and IPv6 addresses.
Note: You can add an sFlow receiver to the BIG-IP system only if you are assigned either the Resource Administrator or Administrator user role. 
Add an sFlow receiver to the BIG-IP system when you want to use the receiver to monitor system performance.
  1. On the Main tab, click System > Performance > sFlow. The sFlow screen opens.
  2. Click Add. The New Receiver properties screen opens.
  3. In the Name field, type a name for the sFlow receiver.
  4. In the Address field, type the IPv4 or IPv6 address on which the sFlow receiver listens for UDP datagrams.
    Note: The IP address of the sFlow receiver must be reachable from a self IP address on the BIG-IP system.
  5. Click Finished.

sFlow counters and data

This table names and categorizes the sFlow counters and informational data that the BIG-IP® system sends to sFlow receivers. The table also includes the source of the data and an example value.

Name and type Source Example value
in_vlan (vlan) VLAN tag 1234 (This value is an integer between 0 [zero] and 4095.)
octets (vlan) ifc_stats.hc_in_octets + ifc_stats.hc_out_octets 107777746
ucastPkts (vlan) ifc_stats.hc_in_ucast_pkts + ifc_stats.hc_out_ucast_pkts 202314
multicastPkts (vlan) ifc_stats.hc_in_multicast_pkts + ifc_stats.hc_out_multicast_pkts 12
broadcastPkts (vlan) ifc_stats.hc_in_broadcast_pkts + ifc_stats.hc_out_broadcast_pkts 6
discards (vlan) ifc_stats.hc_in_discards + ifc_stats.hc_out_discards 0
ifIndex (interface) interface_stat.if_index 64 (You can map this value to an interface name by using snmpwalk to query ifTable, for example, snmpwalk -v 2c -c public localhost ifTable.)
networkType (interface) Enumeration derived from the IANAifType-MIB ( 6
ifSpeed (interface) Media speed of the network interface 1000000000 (This value is in bits per second.)
ifDirection (interface) Derived from MAU MIB (RFC 2668) 0 = unknown, 1=full-duplex, 2=half-duplex, 3 = in, 4=out 1
ifStatus (interface) Bit field with the following bits assigned: bit 0 = ifAdminStatus (0 = down, 1 = up), bit 1 = ifOperStatus (0 = down, 1 = up) 3
ifInOctets (interface) interface_stat.counters.bytes_in 9501109483
ifInUcastPkts (interface) interface_stat.counters.pkts_in - interface_stat.counters.mcast_in 14373120
ifInMulticastPkts (interface) interface_stat.counters.mcast_in 72
ifInBroadcastPkts (interface) interface_stat.rx_broadcast 211
ifInDiscards (interface) interface_stat.counters.drops_in 13
ifInErrors (interface) interface_stat.counters.errors_in 0
ifInUnknownProtos (interface) Not implemented 0
ifOutOctets (interface) interface_stat.counters.bytes_out 9655448619
ifOutUcastPkts (interface) interface_stat.counters.pkts_out - interface_stat.counters.mcast_out 10838396
ifOutMulticastPkts (interface) interface_stat.counters.mcast_out 72
ifOutBroadcastPkts (interface) interface_stat.tx_broadcast 211
ifOutDiscards (interface) interface_stat.counters.drops_out 8
ifOutErrors (interface) interface_stat.counters.errors_out 0
ifPromiscuousMode (interface) Not implemented 0
5s_cpu (processor) cpu_info_stat.five_sec_avg.user + cpu_info_stat.five_sec_avg.nice + cpu_info_stat.five_sec_avg.system + cpu_info_stat.five_sec_avg.iowait + cpu_info_stat.five_sec_avg.irq + cpu_info_stat.five_sec_avg.softirq + cpu_info_stat.five_sec_avg.stolen (This value is the average system CPU usage in the last five seconds.)
1m_cpu (processor) cpu_info_stat.one_min_avg.user +cpu_info_stat.one_min_avg.nice +cpu_info_stat.one_min_avg.system +cpu_info_stat.one_min_avg.iowait +cpu_info_stat.one_min_avg.irq +cpu_info_stat.one_min_avg.softirq +cpu_info_stat.one_min_avg.stolen (This value is the average system CPU usage in the last one minute.)
5m_cpu (processor) cpu_info_stat.five_min_avg.user +cpu_info_stat.five_min_avg.nice +cpu_info_stat.five_min_avg.system +cpu_info_stat.five_min_avg.iowait +cpu_info_stat.five_min_avg.irq +cpu_info_stat.five_min_avg.softirq +cpu_info_stat.five_min_avg.stolen (This value is the average system CPU usage in the last five minutes.)
total_memory_bytes (processor) tmm_stat.memory_total 5561647104 (This value is the total tmm memory in bytes.)
free_memory_bytes (processor) tmm_stat.memory_total - tmm_stat.memory_used 5363754680 (This value is the free tmm memory in bytes.)

Implementation result

You now have an implementation in which the BIG-IP® system periodically sends data samples to an sFlow receiver, and you can use the collected data to analyze the performance of the BIG-IP system.

Table of Contents   |   << Previous Chapter   |   Next Chapter >>

Was this resource helpful in solving your issue?

NOTE: Please do not provide personal information.

Additional Comments (optional)