## ## OSSP flow2rrd -- NetFlow to Round-Robin Database ## Copyright (c) 2004 Ralf S. Engelschall ## Copyright (c) 2004 The OSSP Project ## ## This file is part of OSSP flow2rrd, a tool for storing NetFlow data ## into an RRD which can be found at http://www.ossp.org/pkg/tool/flow2rrd/. ## ## This program is free software; you can redistribute it and/or modify ## it under the terms of the GNU General Public License as published by ## the Free Software Foundation; either version 2 of the License, or ## (at your option) any later version. ## ## This program is distributed in the hope that it will be useful, ## but WITHOUT ANY WARRANTY; without even the implied warranty of ## MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU ## General Public License for more details. ## ## You should have received a copy of the GNU General Public License ## along with this program; if not, write to the Free Software ## Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, ## USA, or contact Ralf S. Engelschall . ## ## flow2rrd.pod: manual page (language: POD) ## =pod =head1 NAME B - NetFlow to Round-Robin Database =head1 VERSION B FLOW2RRD_VERSION_STR =head1 SYNOPSIS B [B<--config=>I] B<--store> B [B<--config=>I] B<--graph> I[C<:>I]C<@>IC<:>IC<:>IC<:>IC<:>IC<:>IC<:>I ... B [B<--config=>I] B<--cgi> B B<--version> B B<--help> =head1 DESCRIPTION B is a companion tool to the B toolkit for storing I network traffic data in an accumulating fixed-size B I (RRD) for visualization purposes. The B' B command is a I data collector which stores received network I data. B reads these I data and stores it into a backend RRD according to pre-configured hosts, targets and services. B can then generate host/target and target/service graphs from the accumulated network traffic data. To support easy on-demand graph generation and displaying, B can be also called from a Web server through CGI to render a small two-layer Web user interface showing graphs of all stored data and allowing a single graph to be displayed with arbitrary size, time-range and data-range adjustments. =head1 OPTIONS =over 4 =item B<-f>|B<--config> I Specifies the path to the F configuration file. See B section below for details on the content of the configuration file. =item B<-s>|B<--store> Enable the I. The B' I data is expected on F with time-ordered records and with the time of the first record to be higher than the time of the last record from last B<--store> operation was. This is a constraint from the backend RRD. =item B<-g>|B<--graph> Enable the I. On the command line one or more arguments of the form I[C<:>I]C<@>IC<:>IC<:>IC<:>IC< :>IC<:>IC<:>I are expected, each specifying the content and output format for a particular graph. Actually, this operation is intended to be used implicitly under the I (see below), but for debugging and manual post-processing reasons (for instance to generate graphs for importing into B or similar RRD based tools) is can be used from the command line, too. The I and I syntax parts have to be strings directly corresponding to the B and B directives in the configuration file. Specifying just I renders a host/target graph, specifying I and I renders a target/service graph. The I syntax part is just the filename where the graph image is written to. If it ends with the extension "C<.png>", the image is generated in PNG format. Else, a GIF format image is generated. The I and I syntax parts are the X and Y sizes of the graph canvas in the generated image. It is I the size of the image as a whole because of surrounding titles, annotations, etc. Reasonable specifications are "C<400:100>" or "C<800:200>". The I and I syntax parts are the start and end times (X axis) of the graph. The values effectively are in seconds since Unix epoch (01-01-1970), but can be also specified as abbreviated [-+]I[C] (e.g. "C<48h>") or as absolute I
-I-I (e.g. "C<24-Dec-2004>") times. Additionally, the time can be relative to each others and to the current time. Finally, "C" specifies the current time. Reasonable specification is "C<-48h:now>". The I and I syntax parts are the upper and lower (Y axis) limits of the graph. The values effectively are in Bit/s, but can be also specified as abbreviated [-+]I[C]. Keep in mind that usually the upper limit has to be positive and the lower limit negative. Specifying a limit as "C<0>" means auto-scaling. Reasonable specifications are "C<0:0>" and "C<2M:-500K>". =item B<-c>|B<--cgi> Enable the I. This option is automatically enabled if the environment variable C is set to the value "C". =item B<-v>|B<--version> Print the B program version. =item B<-h>|B<--help> Print a short command line usage. =back =head1 CONFIGURATION B is configured with a configuration file F (see also option B<--config> above) with a syntax generated by the following grammar: ::= ::= ( | | | | )+ ::= "Database" "{" "}" ";" ::= "Protocol" ";" ::= "Service" (.":".(|"*"))+ ";" ::= "Host" "{" "}" ";" ::= "Colors" + ";" ::= | ::= "Stepping"