IBM Network Performance Insight 1.2.2Document Revision R2E2
Network Performance InsightReferences
IBM
NoteBefore using this information and the product it supports, read the information in “Notices” on page 139.
This edition applies to version 1.2.2.0 of IBM Network Performance Insight and to all subsequent releases andmodifications until otherwise indicated in new editions.
© Copyright IBM Corporation 2015, 2018.US Government Users Restricted Rights – Use, duplication or disclosure restricted by GSA ADP Schedule Contractwith IBM Corp.
Contents
Reference . . . . . . . . . . . . . . vIntended audience . . . . . . . . . . . . vOrganization . . . . . . . . . . . . . . vNetwork Performance Insight architecture . . . . vService Management Connect . . . . . . . . ixNetwork Performance Insight technical training . . ixSupport information . . . . . . . . . . . ixConventions used in this publication . . . . . . ix
Typeface conventions . . . . . . . . . . x
Chapter 1. REST API definitions . . . . 1Flow APIs . . . . . . . . . . . . . . . 1
aggregation . . . . . . . . . . . . . 1interface . . . . . . . . . . . . . . 6qossummary . . . . . . . . . . . . . 10summary . . . . . . . . . . . . . . . 12threshold . . . . . . . . . . . . . . 19timeseries . . . . . . . . . . . . . 22
Metric APIs . . . . . . . . . . . . . . 27anomalies . . . . . . . . . . . . . . 27deviation . . . . . . . . . . . . . . 30entity . . . . . . . . . . . . . . . 36lastValue . . . . . . . . . . . . . . 39metrics . . . . . . . . . . . . . . . 43summary . . . . . . . . . . . . . . . 46timeseries . . . . . . . . . . . . . 53
Threshold API . . . . . . . . . . . . . 58definition . . . . . . . . . . . . . 58
Chapter 2. Command line interface . . 63basecamp-manager-cmd command reference . . . . 63backup command reference . . . . . . . . . 64restore command reference . . . . . . . . . 65
Chapter 3. NetFlow versions . . . . . 67NetFlow V1 formats . . . . . . . . . . . 67NetFlow V5 formats . . . . . . . . . . . 68V9 field type definitions . . . . . . . . . . 70Normalized Flow record fields in NetworkPerformance Insight . . . . . . . . . . . 76
Chapter 4. Dashboard reference . . . . 89Properties of the Network Performance Overviewdashboard . . . . . . . . . . . . . . . 89
Properties of the NetFlow dashboards . . . . . 90Properties of the On Demand Filtering dashboards 91
Chapter 5. SNMP formulas . . . . . . 95Supported Cisco IP SLA formulas . . . . . . . 95Supported Performance Metric OOTB DeviceSupport discovery agents . . . . . . . . . 101Supported Performance Metric OOTB DeviceSupport formulas . . . . . . . . . . . . 105
RFC MIB-II . . . . . . . . . . . . . 106Cisco . . . . . . . . . . . . . . . 112Juniper . . . . . . . . . . . . . . 116Huawei . . . . . . . . . . . . . . 117
Chapter 6. Configuring Flow devices 119Supported devices and flow formats. . . . . . 119Configuring NetFlow on Cisco routers . . . . . 119
Cisco IOS command modes . . . . . . . 120Configuring Flexible NetFlow and ApplicationVisibility and Control (AVC) . . . . . . . 121Enabling NetFlow on your devices . . . . . 125Configuring the Flow Exporters . . . . . . 125Customizing the number of entries in flowcache . . . . . . . . . . . . . . . 127Monitoring NetFlow information . . . . . . 127An example Cisco device configuration. . . . 128
Configuring flow on Juniper devices . . . . . 128Configuring J-Flow versions 5 and 8. . . . . 129Configuring J-Flow version 9 . . . . . . . 130Configuring J-Flow version 9 forSRX-DataCenter devices . . . . . . . . . 132Using the show commands . . . . . . . . 132
Configuring NetStream traffic on Huawei devices 137Configuring NetStream export. . . . . . . 137
Notices . . . . . . . . . . . . . . 139Trademarks . . . . . . . . . . . . . . 141Terms and conditions for product documentation 142
© Copyright IBM Corp. 2015, 2018 iii
iv Network Performance Insight References
Reference
Use the following reference information to enhance your understanding of IBM®
Network Performance Insight and to help you work with IBM NetworkPerformance Insight effectively.
Intended audienceThe audience who are network administrators or operations specialist responsiblefor installing the Network Performance Insight product suite on an enterprisenetwork.
To install Network Performance Insight successfully, you must have a thoroughunderstanding of the following subjects:v Network Performance Insight 1.2.2 systemv Basic principles of network protocols and network managementv NetFlow and Cisco IP SLA conceptsv Administration of the Linuxv Jazz™ for Service Managementv IBM Tivoli® Network Manager IP Editionv IBM Tivoli Netcool®/OMNIbus
OrganizationRead this summary to help you find the information that you need.
This information is organized as follows:v Chapter 1, “REST API definitions,” on page 1v Chapter 2, “Command line interface,” on page 63v Chapter 6, “Configuring Flow devices,” on page 119
Network Performance Insight architectureIBM Network Performance Insight is a network performance monitoring system. Itoffers both real-time and historical trends in network performance and interactiveview on the network data that helps in reduced network downtime and optimizednetwork performance.
Network Performance Insight provides IBM Netcool Operations Insight withcomprehensive IP network device performance monitoring and session trafficanalysis.
The following diagram shows how data is flowing through the variouscomponents in Network Performance Insight:
© Copyright IBM Corp. 2015, 2018 v
Network Performance Insight services
Network Performance Insight services are running on microservice architecturethat has the software application as a suite of independently deployable, small,modular services in which each service runs a unique process and communicatesthrough a well-defined, lightweight mechanism. Currently, Network PerformanceInsight 1.2.2 consists of the following microservices:
Foundation services
v Managerv DNSv Eventv Storagev UI
Entity Metric services
v Tivoli Network Manager Collectorv SNMP Collectorv Formula Servicev Entity Analyticsv Threshold
Flow Metric services
vi Network Performance Insight References
v Flow Collectorv Flow Analytics
For more information about these services, see their respective sections in IBMNetwork Performance Insight: Product Overview.
Network Performance Insight additional components
Some of the additional components that are introduced in Network PerformanceInsight V1.2.2 for enhanced functions are described here:
Performance Metric OOTB Device Support
Performance Metric OOTB Device Support provides some additionalpre-loaded, vendor-specific device performance SNMP metrics that can bediscovered and polled from Tivoli Network Manager system and the datacan be displayed on Network Performance Insight dashboards.
For more information, see Performance Metric OOTB Device Supportsection in IBM Network Performance Insight: Product Overview.
Network Performance Insight Dashboards
These interactive dashboards are the built-in JSON-based dashboards suitethat can display aggregated network data from Network PerformanceInsight database with the help of REST API calls. It supports a combinationof data from multiple data sources.
This feature provides a wide variety of dashboards for Network Operators,Network Engineers, and Network Capacity Planners. These dashboardshelp in pinpointing the troubled resources and general resourceperformance. A number of web-based configuration options are availableto control the data that is displayed on the dashboards.
For more information, see Network Performance Insight Dashboards section inIBM Network Performance Insight: Product Overview.
Note: Networks for Operations Insight is a solution extension of NetcoolOperations Insight that includes the following components and products:v Tivoli Network Managerv Tivoli Netcool Configuration Managerv Network Performance Insightv Network Health Dashboardv Device Dashboardv Topology Search
IBM Open Platform with Apache Spark and Apache Hadoopcomponents
IBM Open Platform with Apache Spark and Apache Hadoop (IOP) can be used tohelp process and analyze the volume, variety, and velocity of data that continuallyenters your organization every day. Network Performance Insight is installed as aservice extension to the installed IBM Open Platform with Apache Spark andApache Hadoop stack.
The features of IOP that are used in Network Performance Insight:
Reference vii
v IBM Open Platform with Apache Spark and Apache Hadoopv Default support for rolling upgrades for Hadoop servicesv Support for long-running applications within YARN for enhanced reliabilityv Spark in-memory distributed compute engine for dramatic performance increasev Apache Ambari operational framework. Apache Ambari is an open framework
for provisioning, managing, and monitoring Apache Hadoop clusters. Ambariprovides an intuitive and easy-to-use Hadoop management web UI backed byits collection of tools and APIs that simplify the operation of Hadoop clusters.
v Essentially includes the following open source technologies for working withNetwork Performance Insight:– HDFS– Kafka– Ambari– Spark– ZooKeeper
Note: Because Zookeeper requires a majority, it is best to use an odd numberof machines. For example, with four machines ZooKeeper can handle thefailure of a single machine; if two machines fail, the remaining two machinesdo not constitute a majority. However, with five machines ZooKeeper canhandle the failure of two machines.
Integrated products
Products that are integrated with Network Performance Insight 1.2.2:
Jazz for Service ManagementDashboard Application Services Hub provides visualization and dashboardservices in Jazz for Service Management. It has a single console foradministering IBM products and related applications. Visualization forNetwork Performance Insight is federated into Dashboard ApplicationServices Hub.
IBM Tivoli Network Manager IP EditionTivoli Network Manager provides network discovery, device polling,including storage of polled SNMP data for reporting and analysis, andtopology visualization. In addition, Network Manager can display networkevents, perform root-cause analysis of network events, and enrich networkevents with topology and other network data.
Tivoli Netcool/OMNIbus component of IBM Netcool Operations InsightNetcool Operations Insight is powered by the fault managementcapabilities of IBM Tivoli Netcool/OMNIbus. In Network PerformanceInsight V1.2.2, Tivoli Netcool/OMNIbus is an important part of thesolution for monitoring the network threshold violations.
Related information:
IBM Network Performance Insight on IBM Knowledge Center
IBM BigInsights 4.2 documentation
HDFS Architecture
Apache Hadoop YARN
Apache Kafka
viii Network Performance Insight References
Apache Zookeeper
IBM Networks for Operations Insight
Service Management ConnectConnect, learn, and share with Service Management professionals and productsupport technical experts who provide their perspectives and expertise.
Access Network and Service Assurance community at https://www.ibm.com/developerworks/servicemanagement/nsa/index.html. Use Service ManagementConnect in the following ways:v Become involved with transparent development, an ongoing, open engagement
between other users and IBM developers of Tivoli products. You can access earlydesigns, sprint demonstrations, product roadmaps, and prerelease code.
v Connect one-on-one with the experts to collaborate and network about Tivoliand the Network and Service Assurance community.
v Read blogs to benefit from the expertise and experience of others.v Use wikis and forums to collaborate with the broader user community.Related information:
IBM Network Performance Insight community on developerWorks
Network Performance Insight technical trainingFor Tivoli technical training information, see the following Network PerformanceInsight Training website at https://tnpmsupport.persistentsys.com/updated_trainings.
Support informationIf you have a problem with your IBM Software, you want to resolve it quickly.IBM provides the following ways for you to obtain the support you need:
OnlineAccess the IBM Software Support site at https://www-947.ibm.com/support/servicerequest/newServiceRequest.action
IBM Support AssistantThe IBM Support Assistant is a free local software serviceability workbenchthat helps you resolve questions and problems with IBM Softwareproducts. The Support Assistant provides quick access to support-relatedinformation and serviceability tools for problem determination. To installthe Support Assistant software, go to https://www.ibm.com/software/support/isa.
Troubleshooting GuideFor more information about resolving problems, see the problemdetermination information for this product.
Conventions used in this publicationSeveral conventions are used in this publication for special terms, actions,commands, and paths that are dependent on your operating system.
Reference ix
Typeface conventionsThis publication uses the following typeface conventions:
Bold
v Lowercase commands and mixed case commands that are otherwisedifficult to distinguish from surrounding text
v Interface controls (check boxes, push buttons, radio buttons, spinbuttons, fields, folders, icons, list boxes, items inside list boxes,multicolumn lists, containers, menu choices, menu names, tabs, propertysheets), labels (such as Tip:, and Operating system considerations:)
v Keywords and parameters in text
Italic
v Citations (examples: titles of publications, diskettes, and CDs)v Words defined in text (example: a nonswitched line is called a
point-to-point line)v Emphasis of words and letters (words as words example: "Use the word
that to introduce a restrictive clause."; letters as letters example: "TheLUN address must start with the letter L.")
v New terms in text (except in a definition list): a view is a frame in aworkspace that contains data.
v Variables and values you must provide: ... where myname represents....
Monospace
v Examples and code examplesv File names, programming keywords, and other elements that are difficult
to distinguish from surrounding textv Message text and prompts addressed to the userv Text that the user must typev Values for arguments or command options
Bold monospace
v Command names, and names of macros and utilities that you can typeas commands
v Environment variable names in textv Keywordsv Parameter names in text: API structure parameters, command
parameters and arguments, and configuration parametersv Process namesv Registry variable names in textv Script names
x Network Performance Insight References
Chapter 1. REST API definitions
The APIs in Network Performance Insight that give access to the database data forconstructing the dashboards.
Using Network Performance Insight REST API commands requires the samepermissions as using the web interface. These REST APIs are available so that youcan retrieve the data outside of the web interface.
Each REST resource contains information such as URLs, functions, parameters,descriptions, sample input, and output data.
Common REST API status codes
HTTP status code Generic description
200 Success
400 Failure
Flow APIsREST APIs that are related Flow data that is collected by Flow Collector Serviceand analyzed by Flow Analytics Service.
aggregationProvides a list of Flow aggregations that are visible to the user.
URL
This API queries and retrieves information from CFG.AGGREGATION_DISABLEtable.http://[host]:[port]/service/dataset/flow/aggregation
http://<myserver.ibm.com>:8081/service/dataset/flow/aggregation
Method
The supported request type.HTTP GET
URL parameters
Name Required Default value Description
visible No true Fields that must bereturned.
Sample URLs/service/dataset/flow/aggregation/service/dataset/flow/aggregation/?visible=true
© Copyright IBM Corp. 2015, 2018 1
Response
The results are returned as JSON data that contains an array of the followingfields:
Name Data type Description
aggregation string The name of the aggregationfield.
agg_fields string The columns that are used togroup by for the calculationof aggregation.
aggregation_name string The name of the aggregationon the flow metric.
visible boolean A flag to indicate whetherthe aggregation is visible tothe user or not.
enabled boolean A flag to indicate whetherthe aggregation is enabled bythe administrator or not.
order_id number It indicates the sorting orderof this list.
JSON code with visible flag set to true:[
{"aggregation":"app","aggregation_name":"Top Applications","agg_fields":"APP_NAME","visible":true,"enabled":true,"order_id":1
},{
"aggregation":"app_srctos","aggregation_name":"Top Applications with Source ToS","agg_fields":"APP_NAME, SRC_TOS","visible":true,"enabled":true,"order_id":2
},{
"aggregation":"srcip","aggregation_name":"Top Sources","agg_fields":"SRC_IP","visible":true,"enabled":true,"order_id":3
},{
"aggregation":"srcip_app","aggregation_name":"Top Sources with Application","agg_fields":"SRC_IP, APP_NAME","visible":true,"enabled":true,"order_id":4
},{
"aggregation":"dstip","aggregation_name":"Top Destinations","agg_fields":"DST_IP",
2 Network Performance Insight References
"visible":true,"enabled":true,"order_id":5
},{
"aggregation":"dstip_app","aggregation_name":"Top Destinations with Application","agg_fields":"DST_IP, APP_NAME","visible":true,"enabled":true,"order_id":6
},{
"aggregation":"conv","aggregation_name":"Top Conversations","agg_fields":"SRC_IP, DST_IP","visible":true,"enabled":true,"order_id":7
},{
"aggregation":"conv_app","aggregation_name":"Top Conversations with Application","agg_fields":"SRC_IP, DST_IP, APP_NAME","visible":true,"enabled":true,"order_id":8
},{
"aggregation":"conv_tos","aggregation_name":"Top Conversations with ToS","agg_fields":"SRC_IP, DST_IP, SRC_TOS","visible":true,"enabled":true,"order_id":9
},{
"aggregation":"prot","aggregation_name":"Top Protocols","agg_fields":"PROTOCOL_ID","visible":true,"enabled":true,"order_id":10
},{
"aggregation":"prot_app","aggregation_name":"Top Protocols with Application","agg_fields":"PROTOCOL_ID, APP_NAME","visible":true,"enabled":true,"order_id":11
},{
"aggregation":"prot_srcip","aggregation_name":"Top Protocols with Source Ip","agg_fields":"PROTOCOL_ID, SRC_IP","visible":true,"enabled":true,"order_id":12
},{
"aggregation":"prot_dstip","aggregation_name":"Top Protocols with Destination Ip","agg_fields":"PROTOCOL_ID, DST_IP","visible":true,"enabled":true,"order_id":13
Chapter 1. REST API definitions 3
},{
"aggregation":"prot_conv","aggregation_name":"Top Protocols with Conversation","agg_fields":"PROTOCOL_ID, SRC_IP, DST_IP","visible":true,"enabled":true,"order_id":14
},{
"aggregation":"srcas","aggregation_name":"Top Source Autonomous System","agg_fields":"BGP_SRC_AS_NUM","visible":true,"enabled":true,"order_id":15
},{
"aggregation":"dstas","aggregation_name":"Top Destination Autonomous System","agg_fields":"BGP_DST_AS_NUM","visible":true,"enabled":true,"order_id":16
},{
"aggregation":"conv_as","aggregation_name":"Top Autonomous System Conversations","agg_fields":"BGP_SRC_AS_NUM, BGP_DST_AS_NUM","visible":true,"enabled":true,"order_id":17
},{
"aggregation":"srctos","aggregation_name":"Top Source ToS","agg_fields":"SRC_TOS","visible":true,"enabled":true,"order_id":18
},{
"aggregation":"hierarchy_queueid","aggregation_name":"Top QoS Hierarchies with Queue Id","agg_fields":"POLICY_QOS_CLASSIFICATION_HIERARCHY, POLICY_QOS_QUEUE_ID","visible":true,"enabled":true,"order_id":19
},{
"aggregation":"dstipgroup_app","aggregation_name":"Top Destination Ip Groups with Application","agg_fields":"DST_IP_GROUP, APP_NAME","visible":true,"enabled":true,"order_id":20
},{
"aggregation":"dstipgroup_prot","aggregation_name":"Top Destination Ip Groups with Protocol","agg_fields":"DST_IP_GROUP, PROTOCOL_ID","visible":true,"enabled":true,"order_id":21
},{
"aggregation":"dstipgroup_tos",
4 Network Performance Insight References
"aggregation_name":"Top Destination Ip Groups with Source ToS","agg_fields":"DST_IP_GROUP, SRC_TOS","visible":true,"enabled":true,"order_id":22
},{
"aggregation":"srcipgroup_app","aggregation_name":"Top Source Ip Groups with Application","agg_fields":"SRC_IP_GROUP, APP_NAME","visible":true,"enabled":true,"order_id":23
},{
"aggregation":"srcipgroup_prot","aggregation_name":"Top Source Ip Groups with Protocol","agg_fields":"SRC_IP_GROUP, PROTOCOL_ID","visible":true,"enabled":true,"order_id":24
},{
"aggregation":"srcipgroup_tos","aggregation_name":"Top Source Ip Groups with Source ToS","agg_fields":"SRC_IP_GROUP, SRC_TOS","visible":true,"enabled":true,"order_id":25
},{
"aggregation":"convgroup_app","aggregation_name":"Top Ip Group Conversations with Application","agg_fields":"SRC_IP_GROUP, DST_IP_GROUP, APP_NAME","visible":true,"enabled":true,"order_id":26
}]
JSON code with visible flag set to false:[
{"aggregation":"convgroup_prot","aggregation_name":"Top Ip Group Conversations with Protocol","agg_fields":"SRC_IP_GROUP, DST_IP_GROUP, PROTOCOL_ID","visible":false,"enabled":false,"order_id":1
},{
"aggregation":"convgroup_tos","aggregation_name":"Top Ip Group Conversations with Source ToS","agg_fields":"SRC_IP_GROUP, DST_IP_GROUP, SRC_TOS","visible":false,"enabled":false,"order_id":2
}]
Chapter 1. REST API definitions 5
interfaceProvides a list of all the flow interfaces that the system received from an exporter.This API is specific for Flow data alone.
URL
This API queries and retrieves information from FLOW_METRIC.INTERFACEtable.http://[host]:[port]/service/dataset/cfg/interface
http://<myserver.ibm.com>:8081/service/dataset/cfg/interface/?fields=*
Method
The supported request type.HTTP GET
URL parameters
Name Required Description
fields No Fields that must be returned.
count No Number of flow interface records thatmust be returned.
sort No How the records must be sorted. Prefix +or - to indicate sort direction. For example,sort=+name,-description. You can givecomma-separated parameters for sorting.
condition No Expression that must be used to filterspecific records. For example,condition=name=test.
Sample URLs/service/dataset/cfg/interface/?fields=*
/service/dataset/cfg/interface/?fields=*&count=10
/service/dataset/cfg/interface/?fields=*&count=10&condition=direction=1&sort=+start_ms
/service/dataset/cfg/interface/?fields=*&count=10&condition=direction=1
Response
The results are returned as JSON data that contains an array of the followingfields:
Name Data type Description
entity_id number Internal system ID for thereturned flow interface.
start_ms number Time at which the flowinterface is first known bythe system.
exporter_ip string IP address of the exporter onwhich the flow interfacesreside.
6 Network Performance Insight References
Name Data type Description
if_index number Index of the flow interfaceon the exporter.
direction number Direction of the flowinterface (0= ingress, 1=egress).
enabled boolean Flag that indicates for datacollection enablement in thesystem for the flow interface.
speed number Speed of the flow interface inbits per second.
if_name string Name of the flow interfaceas known by the exporter.
JSON code:[
{"entity_id":8589934713,"start_ms":1466008543902,"exporter_ip":"::1","if_index":1,"direction":0,"enabled":true,"speed":0,"if_name":"::1-1"
},{
"entity_id":8589934712,"start_ms":1466008543902,"exporter_ip":"::1","if_index":1,"direction":1,"enabled":true,"speed":0,"if_name":"::1-1"
},{
"entity_id":8589935698,"start_ms":1466008551261,"exporter_ip":"::1","if_index":2,"direction":0,"enabled":true,"speed":0,"if_name":"::1-2"
},{
"entity_id":8589935699,"start_ms":1466008551261,"exporter_ip":"::1","if_index":2,"direction":1,"enabled":true,"speed":0,"if_name":"::1-2"
},{
"entity_id":8589936517,"start_ms":1466008555871,"exporter_ip":"::1","if_index":3,
Chapter 1. REST API definitions 7
"direction":0,"enabled":true,"speed":0,"if_name":"::1-3"
},{
"entity_id":8589936516,"start_ms":1466008555871,"exporter_ip":"::1","if_index":3,"direction":1,"enabled":true,"speed":0,"if_name":"::1-3"
},{
"entity_id":8589935276,"start_ms":1466008549135,"exporter_ip":"::1","if_index":4,"direction":0,"enabled":true,"speed":0,"if_name":"::1-4"
},{
"entity_id":8589935277,"start_ms":1466008549135,"exporter_ip":"::1","if_index":4,"direction":1,"enabled":true,"speed":0,"if_name":"::1-4"
},{
"entity_id":8589934754,"start_ms":1466008544992,"exporter_ip":"::1","if_index":5,"direction":0,"enabled":true,"speed":0,"if_name":"::1-5"
},{
"entity_id":8589934755,"start_ms":1466008544992,"exporter_ip":"::1","if_index":5,"direction":1,"enabled":true,"speed":0,"if_name":"::1-5"
},{
"entity_id":8589935289,"start_ms":1466008549182,"exporter_ip":"::1","if_index":6,"direction":0,"enabled":true,"speed":0,"if_name":"::1-6"
},{
"entity_id":8589935288,
8 Network Performance Insight References
"start_ms":1466008549182,"exporter_ip":"::1","if_index":6,"direction":1,"enabled":true,"speed":0,"if_name":"::1-6"
},{
"entity_id":8589935627,"start_ms":1466008551195,"exporter_ip":"::1","if_index":7,"direction":0,"enabled":true,"speed":0,"if_name":"::1-7"
},{
"entity_id":8589935626,"start_ms":1466008551195,"exporter_ip":"::1","if_index":7,"direction":1,"enabled":true,"speed":0,"if_name":"::1-7"
},{
"entity_id":8589934651,"start_ms":1466008543049,"exporter_ip":"::1","if_index":8,"direction":0,"enabled":true,"speed":0,"if_name":"::1-8"
},{
"entity_id":8589934650,"start_ms":1466008543049,"exporter_ip":"::1","if_index":8,"direction":1,"enabled":true,"speed":0,"if_name":"::1-8"
},{
"entity_id":8589935851,"start_ms":1466008551943,"exporter_ip":"::1","if_index":9,"direction":0,"enabled":true,"speed":0,"if_name":"::1-9"
},{
"entity_id":8589935850,"start_ms":1466008551943,"exporter_ip":"::1","if_index":9,"direction":1,"enabled":true,
Chapter 1. REST API definitions 9
"speed":0,"if_name":"::1-9"
}]
qossummaryProvides the summary of policyQosQueueDrop flow metric that measures the QoSqueue drops. This API is applicable for Flow data only.
URL
This API queries and retrieves information from FLOW_METRIC.RAW, and otherFLOW_METRIC. 1MIN/30MIN/1DAY AGGREGATION tables.http://[host]:[port]/service/dataset/aggregation/qossummary
http://<myserver.ibm.com>:8081/service/dataset/aggregation/qossummary?entity=127.0.0.1-533&start=1505887200000&end=1505888940000&count=10
Method
The supported request type.HTTP GET
URL parameters
Name RequiredDefaultvalue Description
entity Yes N/A The entity ID representing theinterface.
The three type of entities are:
v exporterIP-<ifIndex>
v ncim-<NCIM.NETWORK_INTERFACES. entityID>
v flow-<FLOW_METRIC.INTERFACE. entityID>
start Yes N/A The start of the period forwhich flow data that must bereturned.
end Yes N/A The end of the period for whichflow data that must bereturned.
time Yes N/A The name of time short cut:
v last-hour
v last-day
v last-week
v last-month
v last-year
count No -1 Number of queues to return.For example, top 10 talkers ofthe resource.
10 Network Performance Insight References
Name RequiredDefaultvalue Description
remaining No false A flag to indicate whether arow with the total of theremaining records must beprovided.
Sample URL/service/dataset/aggregation/qossummary?entity=127.0.0.1-533&start=1505887200000&end=1505888940000&count=10
/service/dataset/aggregation/qossummary?entity=ncim-342&time=last-hour
/service/dataset/aggregation/qossummary?entity=ncim-342&time=last-hour&remaining=true
Error response
For example:{"errorMesg": "Invalid start, end and granularity combination. Granularity : 1 minute StartMs :1568373360000 endMs : 1468375200000"}
Response
The results are returned as JSON data that contains an array of the followingfields:
Name Data type Description
rank number Rank (1-10) of the record that is relativeto all other records. Rank 11 indicatesremaining records in total.
QueueId number Policy QoS Queue ID
hierarchyName string The hierarchy name for the queuecombined with policy name and classname in format <policyName>-<comma-separated-list of classNames>.
policyName string QoS policy name
classNames string QoS Class Name
droppedPackets number Sum of policyQosQueueDrop metric
droppedPacketPercent number Percent of policyQosQueueDrop for thisqueue over total policyQosQueueDrop forthis interface
droppedPacketOverTotalPacket number Percent of policyQosQueueDrop over totalnumber of packets that pass through thisinterface.
JSON code:[
{"rank":1,"policyName":"Policy1","hierarchyName":"Policy1-Class1","droppedPacketPercent":1.169494703290522,"droppedPacketOverTotalPacket":21.169494703290522,
Chapter 1. REST API definitions 11
"droppedPackets":499,"QueueId":13,"classNames":"Class1"
},{
"rank":2,"policyName":"Policy2","hierarchyName":"Policy2-Class1,Class11","droppedPacketPercent":1.3077716321364956,"droppedPacketOverTotalPacket":21.169494703290522,"droppedPackets":558,"QueueId":8,"classNames":"Class1,Class11"
}]
summaryProvides the top 10 values for an aggregation on a flow interface over a period.This API is specific for Flow data only.
URL
This API queries and retrieves information from FLOW_METRIC.RAW, and otherFLOW_METRIC. 1MIN/30MIN/1DAY AGGREGATION tables.http://[host]:[port]/service/dataset/aggregation/summary
http://<myserver.ibm.com>:8081/service/dataset/aggregation/summary?aggregation=app_srctos&entity=ncim-102&time=lasthour&granularity=1-minutes
Method
The supported request type.HTTP GET
URL parameters
Name Required Default value Description
entity Yes N/A The entity ID that represents theinterface.
The three type of entities are:
v exporterIP-<ifIndex>
v ncim-<NCIM.NETWORK_INTERFACES.entityID>
v flow-<FLOW_METRIC.INTERFACE.entityID>
aggregation Yes N/A The aggregation ID that represents howthe data must be aggregated.
direction No Both The direction of the flow data that mustbe returned.
start Yes N/A The start time of the period for whichflow data must be returned.
end Yes N/A The end time of the period for whichflow data must be returned.
12 Network Performance Insight References
Name Required Default value Description
time Yes N/A The name of time short cut:
v last-hour
v last-day
v last-week
v last-month
granularity No See Notes. The granularity for which the data mustbe aggregated. For example, 5 minutes,14000 minutes.
remaining No false A flag to indicate whether a row with thetotal of the remaining records must beprovided.
extendedAppInfo No false A flag to indicate whether app baseaggregation result contains additionalNBAR, and NBAR2 applicationinformation as follows:
v description
v businessRelevance
v applicationGroup
v applicationCategory
v applicationSubcategory
v p2p_technology
v tunnelTechnology
v encryptedTechnology
Sample URL/service/dataset/aggregation/summary?aggregation=app_srctos&entity=ncim-102&time=lasthour&granularity=1-minutes
/service/dataset/aggregation/summary?aggregation=app&entity=ncim-102&time=lasthour&granularity=1-minutes&extendedAppInfo=true
Error response
For example:{"errorMesg": "Invalid start, end and granularity combination. Granularity : 1 minute StartMs :1568373360000 endMs : 1468375200000"}{"errorMesg":"Missing mandatory parameter :aggregation"}
Response
The results are returned as JSON data that contains an array of the followingfields:
Name Data type Description
rank number Rank (1-10) of the record thatis relative to all otherrecords. Rank 11 indicatesremaining records in total.
Chapter 1. REST API definitions 13
Name Data type Description
application string Application name asspecified in the NBAR2Protocol Pack.Note: Applicable only if theextendedAppInfo parameteris enabled.
description string Description of theapplication as specified inthe NBAR2 Protocol Pack.Note: Applicable only if theextendedAppInfo parameteris enabled.
srctos string Note: Applicable only if theextendedAppInfo parameteris enabled.
octets number The aggregated octets valuefor a time period
packets number The aggregated packetsvalue for a time period
percentage number The relative percentage oftotal octets for a time period.
maxThroughput number The granularity wise maxthroughput(octets) for a timeperiod
avgThroughput number The granularity wise avgthroughput(octets) for a timeperiod
maxUtilization number The granularity wise maxutilization(octets) for a timeperiod
avgUtilization number The granularity wise maxutilization(octets) for a timeperiod
label string Aggregation key values thatare separated by /.
businessRelevance string Specifies whether theapplication is consideredrelevant to the businessactivity of the organization.Note: Applicable only if theextendedAppInfo parameteris enabled.
applicationGroup string Allows the configuration ofapplications that are groupedbased on the samenetworking application asthe match criteria.Note: Applicable only if theextendedAppInfo parameteris enabled.
14 Network Performance Insight References
Name Data type Description
applicationCategory string Allows you to configureapplications that are groupedbased on the first level ofcategorization for eachprotocol as the matchcriteria.Note: Applicable only if theextendedAppInfo parameteris enabled.
applicationSubCategory string Provides the option toconfigure applications thatare grouped based on thesecond level of categorizationfor each protocol as thematch criteria.Note: Applicable only if theextendedAppInfo parameteris enabled.
p2p_technology string Provides the option toindicate whether a protocoluses p2p technology.Note: Applicable only if theextendedAppInfo parameteris enabled.
tunnelTechnology string Provides the option toconfigure protocols based onwhether a protocol tunnelsthe traffic of other protocols.Note: Applicable only if theextendedAppInfo parameteris enabled.
encryptedTechnology string Provides the option toconfigure applications thatare grouped based onwhether the protocol is anencrypted protocol or not asthe match criteria.Note: Applicable only if theextendedAppInfo parameteris enabled.
Note:
v The actual fields returned depend on the type of aggregation in the URL. Therank, octets, and percentage values are constant for all aggregations.
v If granularity is not provided, it is computed as follows:– If time range is <= 3 hours, granularity = 1 minute.– If time range is >3 hour and <=12 hour, granularity = 15 minutes.– If time range is >12 hour and <=7 days, granularity = 30 minutes.– If time range is between 7 and <90 days, granularity = 1 day.– If time range is >=90 days, granularity = 7days.
The supported aggregations are as follows:v app – (application)
Chapter 1. REST API definitions 15
v app_srctos – (applications, source tos)v conv – (source, destination)v conv_app – (source, destination, application)v conv_as – (source autonomous system conversation, destination autonomous
system conversationv conv_tos – (conversations, tos)v convgroup_app – (source ip group, destination ip group, application)v convgroup_prot – (source ip group, destination ip groups, protocol)v convgroup_tos – (source ip group, destination ip groups, source tos)v dstas – (destination autonomous system)v dstip – (destination)v dstip_app – (destination, application)v dstipgroup_app – (destination ip group, application)v dstipgroup_prot – (destination ip group, protocol)v dstipgroup_tos – (destination ip group, source tos)v hierarchy_queueid – (QoS hierarchies with classification, QoS hierarchies with
queue id)v prot – (protocol)v prot_app – (protocol, application)v prot_conv – (protocol, source, destination)v prot_dstip – (protocol, destination)v prot_srcip – (protocol, source)v srcas – (source autonomous system)v srcip – (source)v srcip_app – (source, application)v srcipgroup_app – (source ip group, application)v srcipgroup_prot – (source ip group, protocol)v srcipgroup_tos – (source ip group, source tos)v srctos – (source tos)
JSON code:[
{"rank":1,"application":"ftp","srctos":"AF13","label":"ftp/AF13","octets":22866690,"packets":44379,"percentage":19.43,"maxThroughput":532756.93,"avgThroughput":190555.75,"maxUtilization":0.05,"avgUtilization":0.02
},{
"rank":2,"application":"ssh","srctos":"AF13","label":"ssh/AF13","octets":16502348,"packets":35801,"percentage":14.02,
16 Network Performance Insight References
"maxThroughput":318072.67,"avgThroughput":137519.57,"maxUtilization":0.03,"avgUtilization":0.01
},{
"rank":3,"application":"http","srctos":"AF13","label":"http/AF13","octets":16055850,"packets":38910,"percentage":13.64,"maxThroughput":370810.53,"avgThroughput":152912.86,"maxUtilization":0.04,"avgUtilization":0.02
},{
"rank":4,"application":"https","srctos":"AF13","label":"https/AF13","octets":10447134,"packets":18166,"percentage":8.88,"maxThroughput":260432.53,"avgThroughput":107150.09,"maxUtilization":0.03,"avgUtilization":0.01
},{
"rank":5,"application":"bootps","srctos":"AF13","label":"bootps/AF13","octets":9739971,"packets":17876,"percentage":8.28,"maxThroughput":230403.47,"avgThroughput":118060.25,"maxUtilization":0.02,"avgUtilization":0.01
},{
"rank":6,"application":"nicname","srctos":"AF13","label":"nicname/AF13","octets":9577779,"packets":19000,"percentage":8.14,"maxThroughput":178783.87,"avgThroughput":91216.94,"maxUtilization":0.02,"avgUtilization":0.01
},{
"rank":7,"application":"sqlserv","srctos":"AF13","label":"sqlserv/AF13","octets":9437316,"packets":26845,"percentage":8.02,"maxThroughput":340232.93,"avgThroughput":125830.88,
Chapter 1. REST API definitions 17
"maxUtilization":0.03,"avgUtilization":0.01
},{
"rank":8,"application":"domain","srctos":"AF13","label":"domain/AF13","octets":9058840,"packets":14997,"percentage":7.70,"maxThroughput":287669.60,"avgThroughput":109804.12,"maxUtilization":0.03,"avgUtilization":0.01
},{
"rank":9,"application":"irc","srctos":"AF13","label":"irc/AF13","octets":7185223,"packets":9944,"percentage":6.10,"maxThroughput":197913.07,"avgThroughput":106447.75,"maxUtilization":0.02,"avgUtilization":0.01
},{
"rank":10,"application":"bootpc","srctos":"AF13","label":"bootpc/AF13","octets":6827520,"packets":9747,"percentage":5.80,"maxThroughput":159044.53,"avgThroughput":82757.82,"maxUtilization":0.02,"avgUtilization":0.01
}]
Response for the URL with extendedAppInfo flag set:[
{"rank":1,"application":"ftp","description":"","businessRelevance":"","applicationGroup":"","applicationCategory":"","applicationSubCategory":"","p2p_technology":"","tunnelTechnology":"","encryptedTechnology":"","label":"ftp","octets":1627476,"packets":5392,"percentage":17.00,"maxThroughput":216996.80,"avgThroughput":216996.80,"maxUtilization":0.02,"avgUtilization":0.02
},
18 Network Performance Insight References
{"rank":2,"application":"bootps","description":"","businessRelevance":"","applicationGroup":"","applicationCategory":"","applicationSubCategory":"","p2p_technology":"","tunnelTechnology":"","encryptedTechnology":"","label":"bootps","octets":1600439,"packets":3975,"percentage":16.71,"maxThroughput":213391.87,"avgThroughput":213391.87,"maxUtilization":0.02,"avgUtilization":0.02
}]
Related information:
NBAR Categorization and Attributes
NBAR2 Protocol Pack 33.0.0
thresholdProvides a list of all the thresholds on Flow data in the system. This API is specificfor Flow data only.
URL
This API queries and retrieves information from CFG.THRESHOLD table.http://[host]:[port]/service/dataset/cfg/threshold
http://<myserver.ibm.com>:8081/service/dataset/cfg/threshold/?fields=*
Method
The supported request type.HTTP GET
URL parameters
Name Required Description
fields No Fields that must be returned.
count No Number of Flow interfacerecords that must be returned.
sort No How the records must be sorted.Prefix + or - to indicate sortdirection. For example,+metric,-upper_limit indicatesto sort by metric ascending, andthen sort by upper_limitdescending. You can givecomma-separated parameters forsorting.
Chapter 1. REST API definitions 19
Name Required Description
condition No Expression that must be used tofilter specific records. Forexample, condition=name=test.
Sample URLs/service/dataset/flow/threshold/?fields=*
/service/dataset/flow/threshold/?fields=*&count=5
/service/dataset/flow/threshold/?fields=*&count=10&condition=direction=1&sort=+start_ms
/service/dataset/flow/threshold/?fields=*&count=10&condition=direction=1
Response
The results are returned as JSON data that contains an array of the followingfields:
Name Data type Description
entity_id number The internal system ID forthe returned Flow interface
metric_id number The internal system ID forthe metric
start_ms number The system time whenthreshold is configured.
period_sec number The accumulated time inseconds when the thresholdis monitored.
enabled boolean Flag to indicate whetherthreshold monitoring isenabled in the system for theFlow interface.
kind number The type of thresholdmonitored. 0 is StaticThreshold and 1 is LearnedThreshold.Note: Currently, it is notsupported and it alwaysreturns 0.
limit_type number The limit type for thresholdmonitored.
v 0 is Over
v 1 is Under
v 2 is Band
upper_limit number The upper bound limit forthe threshold monitored
lower_limit number The lower bound limit forthe threshold monitored
num_events number The number of events thatare generated on the Flowinterface.
20 Network Performance Insight References
Name Data type Description
learning_days number The number of days for thesystem to learn the pattern.Note: Currently, it is notsupported.
interface_id number The internal system ID forthe returned Flow interface
direction number The direction of the Flowinterface (0=ingress,1=egress)
speed number The speed of the Flowinterface in bits per second
exporter_ip string The IP address of theexporter on which the Flowinterfaces reside.
if_index number The index of the Flowinterface on the exporter
if_name string The name of the Flowinterface as known by theexporter
JSON code:[
{"entity_id":8589934601,"metric_id":1,"start_ms":1472466812124,"period_sec":60,"enabled":false,"kind":0,"limit_type":0,"upper_limit":80923502,"lower_limit":60692626,"num_events":2,"learning_days":0,"interface_id":8589934601,"direction":0,"speed":0,"exporter_ip":"::1","if_index":1,"if_name":"::1-1"
},{
"entity_id":8589934600,"metric_id":1,"start_ms":1472466812125,"period_sec":60,"enabled":false,"kind":0,"limit_type":0,"upper_limit":62739672,"lower_limit":47054754,"num_events":2,"learning_days":0,"interface_id":8589934600,"direction":1,"speed":0,"exporter_ip":"::1",
Chapter 1. REST API definitions 21
"if_index":1,"if_name":"::1-1"
}]
timeseriesProvides a timeseries of data for an aggregation on a flow interface over a period.For timeseries return with top10 query, the utilization is only calculated if thespeed information is available in NCIM database. If the information is notavailable, value null is returned.
URL
This API queries and retrieves information from FLOW_METRIC.RAW, and otherFLOW_METRIC. 1MIN/30MIN/1DAY AGGREGATION tables.http://[host]:[port]/service/dataset/aggregation/timeserieshttp://[host]:[port]/service/dataset/aggregation/timeseries/top10
http://<myserver.ibm.com>:8081service/dataset/aggregation/timeseries?entity=ncim-217&direction=ingress&aggregation=conv_app&start=1466008260000&end=1466011860000&granularity=1-minute&key=221.87.136.94%252F176.188.66.226%2520%252F%2520ftp-data
Method
The supported request type.HTTP GET
URL parameters
Name Required Default value Description
entity Yes N/A The entity ID that representsthe interface.
aggregation Yes N/A The aggregation ID thatrepresents how the data mustbe aggregated.
direction No Both The direction of the flow datathat must be returned.
start Yes N/A The start time of the period forwhich flow data must bereturned.
end Yes N/A The end time of the period forwhich flow data must bereturned.
granularity No N/A The granularity for which thedata must be aggregated. Thedefault granularity can be asfollows:
v 1-minute
v 15-minute
v 30-minute
v 1-day
v 7-day
22 Network Performance Insight References
Name Required Default value Description
key Yes
No (For top10query)
N/A Combination of grouping keysthat are separated by /. Thiskey must be in the sameaggregation order and supportonly the top 10 grouping fromaggregation summary.
The grouping key value mustbe same as the grouping resultof aggregation summary API.The key parameter is ignoredfor top10 where all top 10timeseries data is returned.
time Yes N/A The name of time short cut:
v last-hour
v last-day
v last-week
v last-month
v last-year
suppressSummary No false Output result without resultsummary portion.
Sample URL/service/dataset/aggregation/timeseries?entity=ncim-217&direction=ingress&aggregation=conv_app&start=1466008260000&end=1466011860000&granularity=1-minute&key=221.87.136.94%252F176.188.66.226%2520%252F%2520ftp-data
/service/dataset/aggregation/timeseries/top10?entity=ncim-217&direction=ingress&aggregation=conv_app&start=1466008260000&end=1466011860000&granularity=1-minute
Note:
v The query supports the top 10 grouping from the aggregation summary for theprovided time period.
v This query runs on aggregation summary result cache and the parameter keyvalue must be as appeared in aggregation summary API result.
v If granularity is not provided, it is computed as follows:– If time range is <= 3 hours, granularity = 1 minute.– If time range is >3 hour and <=12 hour, granularity = 15 minutes.– If time range is >12 hour and <=7 days, granularity = 30 minutes.– If time range is between 7 and <90 days, granularity = 1 day.– If time range is >=90 days, granularity = 7days.
Error response
For example:{"errorMesg":"Missing mandatory parameter :aggregation"}{"errorMesg": "Invalid start, end and granularity combination. Granularity : 1 minute StartMs :1568373360000 endMs : 1468375200000"}{"errorMesg":"Key parameter must be provided"}
Chapter 1. REST API definitions 23
Response
The timeseries API query results are returned as JSON data that contains an arrayof the following fields:
Name Data type Description
timestamp number The time that is associatedwith the aggregated value.
value number The aggregated octets valuefor the associated time
JSON code:[
{"timestamp":1466008980000,"value":999771
},{
"timestamp":1466008990000,"value":999771
},{
"timestamp":1466009000000,"value":999771
},{
"timestamp":1466009100000,"value":999771
}]
The timeseries/top10 API query results are returned as JSON data that containsan array of the header and result fields as follows:
Table 1. Header fields
Name Data type Description
interface number The interface for which top10 timeseries is calculated.
direction number The direction of the interface
exporter string The exporter IP of theinterface
keysSeparator string The separator that is used forcombining the groupingkeys.
keys string The grouping keys that areused for the aggregation.
speed long The speed of the interface.
Table 2. Result Fields
Name Data type Description
key string The grouping key value for thisrecord,
timestamp long The time that is associated withthe aggregated value.
24 Network Performance Insight References
Table 2. Result Fields (continued)
Name Data type Description
sumOctet long The sumoctets that is calculatedfor this grouping key value.
sumPacket long The sumpackets that is calculatedfor this grouping key value.
throughput double The number of packetsaggregated per granularityspecified.
utilization string It is the throughput based onspeed of the interface.
JSON code without timeseries/top10 query[
{"timestamp":1466008980000,"value":999771
},{
"timestamp":1466008990000,"value":999771
},{
"timestamp":1466009000000,"value":999771
},{
"timestamp":1466009100000,"value":999771
}]
JSON code for timeseries/top10 query:{
"interface":1,"direction":"ingress","exporter":"127.0.0.1","keysSeparator":"/","speed":10000000,"keys":[
"srcIp","dstIp","appName"
],"timeseries":[
{"key":"56.199.177.191/40.47.23.8/https","timestamp":1503540000000,"sumOctet":998005,"sumPacket":8457,"throughput":887.1155555555556,"utilization":0.008871155555555557
},{
"key":"192.178.122.236/61.186.117.57/https","timestamp":1503540000000,"sumOctet":996126,"sumPacket":1617,"throughput":885.4453333333333,"utilization":0.008854453333333333
},
Chapter 1. REST API definitions 25
{"key":"132.118.233.143/212.104.175.192/nntp","timestamp":1503540000000,"sumOctet":999710,"sumPacket":1308,"throughput":888.6311111111111,"utilization":0.00888631111111111
},{
"key":"176.3.79.144/98.139.180.149/ipv6:21","timestamp":1503540000000,"sumOctet":996046,"sumPacket":4955,"throughput":885.3742222222222,"utilization":0.008853742222222223
},{
"key":"212.219.83.229/91.32.174.183/ftp","timestamp":1503540000000,"sumOctet":999397,"sumPacket":4714,"throughput":888.3528888888889,"utilization":0.008883528888888888
},{
"key":"143.94.84.129/89.245.62.143/ftp-data","timestamp":1503540000000,"sumOctet":997156,"sumPacket":1959,"throughput":886.3608888888889,"utilization":0.00886360888888889
},{
"key":"149.86.219.239/5.191.66.50/ipv6:445","timestamp":1503540000000,"sumOctet":999563,"sumPacket":962,"throughput":888.5004444444445,"utilization":0.008885004444444445
},{
"key":"232.149.79.235/18.156.162.132/sctp:68","timestamp":1503540000000,"sumOctet":999358,"sumPacket":4781,"throughput":888.3182222222222,"utilization":0.008883182222222223
},{
"key":"remaining","timestamp":1503540000000,"sumOctet":1096729557,"sumPacket":7823086,"throughput":9001125.84088889,"utilization":90.01125840888889
},{
"key":"127.105.91.253/251.24.126.55/ftp","timestamp":1503540000000,"sumOctet":999579,"sumPacket":1516,"throughput":888.5146666666667,"utilization":0.008885146666666668
},{
"key":"165.147.4.136/132.106.235.232/ipv6:53","timestamp":1503540000000,
26 Network Performance Insight References
"sumOctet":999932,"sumPacket":1022,"throughput":888.8284444444445,"utilization":0.008888284444444445
}]
}
Metric APIsREST APIs that retrieve entity metric data that is collected by Network ManagerCollector Service and analyzed by Entity Analytics Service.
anomaliesProvides anomalies in timeseries entity metric data. This information is used in theDevice Dashboard to display the network anomalies.
URL
This API queries and retrieves information from THRESHOLD.STATE table.http://[host]:[port]/service/dataset/metric/anomalies
http://<myserver.ibm.com>:8081/service/dataset/metric/anomalies
Method
The supported request type.HTTP GET
URL parameters
Name RequiredDefaultvalue Description
entities No N/A Comma-separated list of ncimentity IDs.
entityNames No N/A Comma-separated list of entitynames
metrics Yes N/A Comma-separated names of themetrics and their aggregationexpression.
parents No N/A Comma-separated list of mainnode ID.
parentNames No N/A Comma-separated list of ncimdevice names
searchByProperties No N/A Properties filter in this format:
"<propertyName>"<ops>’<propertyValue>’
Note: Property name and valueare case-sensitive.For example:
"IFTYPESTRING"=’ethernet-csmacd’
start No N/A The start of the period forwhich flow data that must bereturned.
Chapter 1. REST API definitions 27
Name RequiredDefaultvalue Description
end No N/A The end of the period for whichflow data that must bereturned.
time No N/A The name of time short cutused. For example:
v last-hour
v last-day
v last-week
v last-month
v last-year
excludeParent No false A flag to exclude the parent IDfrom response.
childTypes No * Comma-separated list of entitytypes of node that must befiltered in the result. SupportedchildTypes filter values areinterface, device, probe, and *(All).
entityResourceTypes No N/A Entity Type of node that mustbe filtered in result. Forexample:
v interface
v device
v probe
v physicalcard
v artTarget
v qosQueue
Sample URLs/service/dataset/metric/anomalies?entities=ncim-59,ncim-81,ncim-86&time=lastweek&metrics=ifInDiscards
/service/dataset/metric/anomalies?entities=ncim-59&start=1466008260000&end=1466011860000&metrics=ifInDiscards
/service/dataset/metric/anomalies?entities=ncim-59&start=1466008260000&end=1466011860000&metrics=ifInDiscards,ifOutDiscards
/service/dataset/metric/anomalies?entityNames=T1 1/1,T1 1/2&start=1466008260000&end=1466011860000&metrics=ifInDiscards
/service/dataset/metric/anomalies?parents=1,2&entities=ncim-59&start=1466008260000&end=1466011860000&metrics=ifInDiscards,ifOutDiscards
/service/dataset/metric/anomalies?parentNames=10.55.239.42,10.55.239.4&entityNames=T11/1&start=1466008260000&end=1466011860000&metrics=ifInDiscards
/service/dataset/metric/anomalies?start=1466008260000&end=1466011860000&metrics=ifInDiscards&searchByProperties="PHYSICALADDRESS"=’30’ AND "LOCATION"=’KL’
/service/dataset/metric/anomalies?parents=3&metrics=snmpInBandwidth&time=lastday&childTypes=interface,device
Note:
v At least one or more of the following parameters must be provided:– entities
28 Network Performance Insight References
– parents
– entityNames
– parentNames
– searchByProperties
– entityResourceTypes
v time or a combination of start AND or OR end must be provided.v time parameter is superseded by combination of start AND or OR end if both
combinations are present and it must support last-hour and last_day only.v Supported operators for properties filter are as follows:
– ,– =– <>– IN– LIKE– AND– ORFor example:searchByProperties="sysName"=’"10.55.239.40"’ AND "If"=’897’searchByProperties="sysName"=’"10.55.239.40"’ AND "If" IN (’897’,’898’)searchByProperties="sysName" like ’"10.55.239.%25"’ AND "If"=’897’
Note: “%” is reserved keyword. It must be encoded with %25.
Error Response{"errorMesg":"Either entities, parents, entityNames, parentNames or searchByProperties should beprovided"}{"errorMesg": "Invalid start, end and granularity combination. Granularity : 1 minute StartMs :1568373360000 endMs : 1468375200000"}
Response
The results are returned as JSON data that contains an array of the followingfields:
Name Data type Description
entity number The entity that is associated with thetime and metric value.
parent number The parent entity ID that is associatedwith the entity. The value is defaulted to-1 if enrichment fails.
entityName string The entity name. The value is defaultedto unknown if enrichment fails.
parentName string The entity’s parent name. The value isdefaulted to unknown if enrichment fails.
metric string The metric name for the associated timeand metric value.
type string The type of anomaly that is detected.
severity string The severity of the anomaly.
Chapter 1. REST API definitions 29
Name Data type Description
start number The time that is associated with the startof the anomaly.
end number The time that is associated with the endof the anomaly.
This field is available when the anomalyis ended, but not when anomaly is stilloutstanding.
value number The last violation metric value for theassociated time
details string JSON blob that contains the details ofthe anomaly.
JSON code:[
{"parent":6,"entityName":"","parentName":"10.55.239.2","metric":"ifInDiscards","entity":59,"details":"{’effectiveTimeStamp’:1472098732320,’limitType’:0,’upperLimit’:10,’lowerLimit’:5,’numEvents’:2}","severity":"critical","type":"StaticThreshold","start":1472099473383,"value":20
},{
"parent":6,"entityName":"0","parentName":"10.55.239.2","metric":"ifInDiscards","entity":81,"details":"{’effectiveTimeStamp’:1472098732320,’limitType’:0,’upperLimit’:10,’lowerLimit’:5,’numEvents’:2}","severity":"critical","type":"StaticThreshold","start":1472099473384,"value":10
}]
deviationComputes deviation for the current data that is compared against average value onthe same day of week over N number of weeks.
URL
The deviation REST API is used to compare against an aggregated metric datafrom a specific start and end time stamp and lookBackWeek to produce a TopNresource list.
Consider the following scenario:v You provide a start and end time from 1 AM - 2 AM Monday, 28 August 2017.v You select the lookBackWeek of 1.v You select the average value for a specific metric.
In this scenario, the deviation REST API queries all the related device types;interface, physical card, and probe, and the average value of the metric for theperiod of 7 days earlier, that is, Monday , 21 August 2017. The API also comparesthe results and retrieves the top ranking list.
30 Network Performance Insight References
This API queries and retrieves information from ENTITY_METRIC.AGG_030MIN,ENTITY_METRIC.RAW, NCIM.NETWORK_INTERFACES tables.http://[host]:[port]/service/dataset/metric/deviation
http://<myserver.ibm.com>:8081/service/dataset/metric/deviation
Method
The supported request type.HTTP GET
URL parameters
Name Required Default value Description
entities No N/A Comma-separated list of entity IDs
entityNames No N/A Comma-separated list of entitynames
metrics Yes N/A Comma-separated names of themetrics. Also supports metric IDs.
parents No N/A Comma-separated list of mainnode IDs.Note: Must be associated withchildTypes for ART, QoS relatedmetrics.
parentNames No N/A Comma-separated list of ncimdevice names.Note: Must be associated withchildTypes for ART and QoSrelated metrics.
searchByProperties No N/A Properties filter in this format:
"<propertyName>"<ops>’<propertyValue>’
Note: Property name and valueare case-sensitive.For example:
"IFTYPESTRING"=’ethernet-csmacd’
start No N/A The start time for which flow datamust be returned.Note: The start and end timeperiods for deviation must beminimum 30 minutes and notlonger than 1 day.
end No N/A The end time for which flow datamust be returned.Note: The start and end timeperiods for deviation must beminimum 30 minutes and notlonger than 1 day.
time No N/A Specific time values:
v last-hour
v last-day
Note: You need either start/endor time parameters in the URL.
Chapter 1. REST API definitions 31
Name Required Default value Description
lookBackWeek Yes N/A The number of weeks to look back.lookBackWeek for deviation isalways <=4.
scope No
Yes forART/QoSmetrics
ibm-itnm
flow
Scope of the resource. Scope isrequired for ART, QoS relatedmetrics.
childTypes No * Comma-separated list of entitytypes of nodes that must befiltered in the result. By default, itis device and interface. SupportedchildTypes filter values are asfollows:
v interface
v device
v probe
v physicalcard
v artTarget
v qosQueue
v * (All)
suppressSummary No false Output the result without thesummary portion.
count No -1 Number of entities summary thatmust be returned. Combined withsort provides topN or bottomNfunctions. The default value -1returns all available records.
page No 1 The index of the page with data toreturn. It must be supplied withcount parameter to indicate thepage size.
properties No N/A Comma-separated list of propertiesto output.
flowEnabled No false If set to true, the result mustcontain the flow enabled entities.
entityResourceTypes No N/A Entity Type of node that must befiltered in result. For example:
v interface
v device
v probe
v physicalcard
v artTarget
v qosQueue
excludeParent No false A flag to exclude the parent IDsfrom response.
parentChildRelation No union Set operation between result fromparent ID search and entity IDsearch. For example, intersection,union.
32 Network Performance Insight References
Sample URLs/service/dataset/metric/deviation?entities=ncim-217&metrics=snmpInBandwidth&start=1466008260000&end=1466011860000
/service/dataset/metric/deviation?entities=ncim-217,ncim-218&metrics=snmpInBandwidth&time=last-hour
/service/dataset/metric/deviation?entities=ncim-217&metrics=snmpInBandwidth&time=last-hour/service/dataset/metric/deviation?entities=ncim-217&metrics=snmpInBandwidth&start=1466008260000&end=1466011860000
/service/dataset/metric/deviation?entityNames=T1 1/1,T1 1/2&metrics=snmpInBandwidth&start=1466008260000&end=1466011860000
/service/dataset/metric/deviation?entities=ncim-217,ncim-218&metrics=snmpInBandwidth&time=last-hour
/service/dataset/metric/deviation?metrics=snmpInBandwidth&time=lasthour&searchByProperties="PHYSICALADDRESS"=’30’ AND "LOCATION"=’KL’
/service/dataset/metric/deviation?parents=3&metrics=snmpInBandwidth&time=lastday&childTypes=interface,device
/service/dataset/metric/deviation?parents=760&metrics=PingResult&time=last-day&lookBackWeek=4
Note:
v At least one or more of the following parameters must be provided:– entities
– parents
– entityNames
– parentNames
– searchByProperties
– entityResourceTypes
v Supported operators for properties filter are as follows:– ,– =– <>– IN– LIKE– AND– ORFor example:searchByProperties="sysName"=’"10.55.239.40"’ AND "If"=’897’searchByProperties="sysName"=’"10.55.239.40"’ AND "If" IN (’897’,’898’)searchByProperties="sysName" like ’"10.55.239.%25"’ AND "If"=’897’
Note: “%” is reserved keyword. It must be encoded with %25.v time or a combination of start AND or OR end must be provided.v start and end range must be minimum of 30 minutes and maximum 1 day.v time parameter is superseded by combination of start AND or OR end. It must
support last-hour or last_day only.v lookBackWeek parameter must contain the value greater than 0.v count parameter must be used to get top N resources.v Data must always be sorted by deviation value.
Error response
For example:
Chapter 1. REST API definitions 33
{"errorMesg":"Either entities, parents, entityNames, parentNamesor searchByProperties should be provided"}{"errorMesg":"lookBackWeek is a mandatory parameter and shouldcontain value greater than zero"}{"errorMesg":"Time range between start and end should be minimum 30-minsto maximum 1 day"}{"errorMesg":"Metric Deviation Servlet support only 1 metric"}
Response
The results are returned as JSON data that contains an array of the followingfields:
Name Data type Description
total number Total number of records available
page number Current page number
count number Number of records in the page
items list The list of entity metric summary
entity number The entity ID that is associated withthe time and metric value.
parent number The parent Entity ID that is associatedwith the entity.
entityName string The entity name. This value isdefaulted to unknown, if enrichmentfails.
parentName string Parent entity name. This value isdefaulted to unknown, if enrichmentfails.
startTimestamp number The start time that is associated withthe metric value.
endTimestamp number The end time that is associated withthe metric value.
metric string The metric name for the associatedtime and metric value. If metricId isused for search, this attribute returnsthe metric name.
rank number The rank (1-N) of the record relative toall other entities based on sort. Defaultis 0 if sort parameter is not provided.
devValues number The metric deviation value for theassociated time, entity, and metricexpression.
properties map Map of properties that are given ininput parameters and their values.
inIfId number In interface IDs for given entities ifenriched.
outIfId number Out interface IDs for given entities ifenriched.
JSON code without suppressSummary flag set:{
"total":27,"page":1,"count":27,
34 Network Performance Insight References
"items":[{
"entity":59,"parent":59,"entityName":"entityName","parentName":"parentName","startTimestamp":1469515500000,"endTimestamp":1469615500000,"rank":1,"devValues":100,"metricId":"MetricName","metric":10,"inIfId":11,"outIfId":12
},{
"entity":58,"parent":58,"entityName":"entityName","parentName":"parentName","startTimestamp":1469515500000,"endTimestamp":1469615500000,"rank":2,"devValues":99,"metricId":"MetricName","metric":10,"inIfId":11,"outIfId":12
}]
}
JSON code with suppressSummary flag set:[
{"entity":59,"parent":59,"entityName":"entityName","parentName":"parentName","startTimestamp":1469515500000,"endTimestamp":1469615500000,"rank":1,"devValues":100,"metricId":"MetricName","metric":10,"inIfId":11,"outIfId":12
},{
"entity":60,"parent":60,"entityName":"entityName","parentName":"parentName","startTimestamp":1469515500000,"endTimestamp":1469615500000,"rank":2,"devValues":100,"metricId":"MetricName","metric":10,"inIfId":11,"outIfId":12
}]
Chapter 1. REST API definitions 35
entityProvides a list of entities and their properties for a resource type and searchconditions.
URL
This API queries and retrieves information from NCIM.NETWORK_INTERFACES,INVENTORY.ENTITY_NAME, INVENTORY.ENTITY_PROPERTIES andENTITY_METRIC.RAW and ENTITY_METRIC aggregated tables.http://[host]:[port]/service/dataset/metric/entity
http://<myserver.ibm.com>:8081/service/dataset/metric/entity
Method
The supported request type.HTTP GET
URL parameters
Name RequiredDefaultvalue Description
entityResourceTypes No N/A Comma-separated list of entityIDs
all No false Comma-separated list of entitynames
searchByEntity No N/A Comma-separated list of EntityIDs, Entity names, Parent EntityIDs, Parent Entity names, andtype. <entity_column> can contain<entity_id>, <entity_name>,<parent_entity_id>, <parent_name>,and <type>.
<entity_column> <ops> ’<value>’
For example:
entity_id=’449900’
properties No N/A Comma-separated list ofproperties to output.
searchByProperties No N/A Properties filter in this format:
"<propertyName>"<ops>’<propertyValue>’
Note: Property name and valueare case-sensitive.For example:
"IFTYPESTRING"=’ethernet-csmacd’
flowEnabled No false If set to true, the result mustcontain the flow enabled entities.
parentChildRelation No union Set operation between result fromparent ID search and entity IDsearch. For example, intersection,union.
36 Network Performance Insight References
Sample URLs/service/dataset/metric/entity?entityResourceTypes=device
/service/dataset/metric/entity?entityResourceTypes=interface&flowEnabled=true
/service/dataset/metric/entity?entityResourceTypes=device&all=true
/service/dataset/metric/entity?searchByEntity=parentName=’10.55.239.249’
/service/dataset/metric/entity?entityResourceTypes=interface&flowEnabled=true
Note:
v At least one or more of the following parameters must be provided:– entities
– parents
– entityNames
– parentNames
– searchByEntity
– searchByProperties
– entityResourceTypes
v Supported fields for searchByEntity are as follows:– parentName
– entityName
– entityId
– parentEntityId
v Supported operators for properties filter are as follows:– ,– =– <>– IN– LIKE– AND– ORFor example:searchByProperties="sysName"=’"10.55.239.40"’ AND "If"=’897’searchByProperties="sysName"=’"10.55.239.40"’ AND "If" IN (’897’,’898’)searchByProperties="sysName" like ’"10.55.239.%25"’ AND "If"=’897’
Note: “%” is reserved keyword. It must be encoded with %25.v Supported pattern for searchByEntity is as follows:
searchByEntity=parentName=’10.55.239.249’
Error response
For example:{"errorMesg":"Either entities, parents, entityNames, parentNames, entityResourceTypes,searchByEntity or serachByProperties should be provided"}
Response
The results are returned as JSON data that contains an array of the followingfields:
Chapter 1. REST API definitions 37
Name Data type Description
entityId number An entity ID
entityName string Name of the entity
parentId number Parent entity ID
parentName string Parent entity name
properties map Map of properties that are given ininput parameters their values.
inIfId number Inbound interface IDs for the entities ifthey are enriched.
outIfId number Outbound interface IDs for the entitiesif they are enriched.
JSON code without flowEnabled flag set is as follows:[
{"entityId":-1,"entityName":"ALL","parentId":-1,"parentName":"ALL"
},{
"entityId":5,"entityName":"10.55.239.202","parentId":5,"parentName":"10.55.239.202"
},{
"entityId":1,"entityName":"10.55.239.201","parentId":1,"parentName":"10.55.239.201"
},{
"entityId":6,"entityName":"10.55.239.4","parentId":6,"parentName":"10.55.239.4"
},{
"entityId":9,"entityName":"10.55.239.221","parentId":9,"parentName":"10.55.239.221"
},{
"entityId":7,"entityName":"10.55.239.249","parentId":7,"parentName":"10.55.239.249"
},{
"entityId":3,"entityName":"10.55.239.3","parentId":3,"parentName":"10.55.239.3"
},{
"entityId":8,"entityName":"10.55.239.250","parentId":8,
38 Network Performance Insight References
"parentName":"10.55.239.250"},{
"entityId":4,"entityName":"10.55.239.203","parentId":4,"parentName":"10.55.239.203"
}]
JSON code with flowEnabled flag set is as follows:[
{"entityId":995,"inIfId":8589936607,"entityName":"Se1/0:0","parentName":"10.55.239.250","outIfId":8589936606,"parentId":960
}]
lastValueRetrieves the last value of metric data.
URL
This API queries and retrieves information from ENTITY_METRIC.RAW table.http://[host]:[port]/service/dataset/metric/lastValue
http://<myserver.ibm.com>:8081/service/dataset/metric/lastValue?entities=ncim-217,ncim-218&metrics=snmpInBandwidth&time=last-hour
Method
The supported request type.HTTP GET
URL parameters
Name RequiredDefaultvalue Description
entities No N/A Comma-separated list of entityIDs
entityNames No N/A Comma-separated list of entitynames
metrics Yes N/A Comma-separated names of themetrics. Also supports metricIDs.
parents No N/A Comma-separated list of mainnode IDs.Note: Must be associated withchildTypes for ART, QoS relatedmetrics.
parentNames No N/A Comma-separated list of ncimdevice names.Note: Must be associated withchildTypes for ART, QoS relatedmetrics.
Chapter 1. REST API definitions 39
Name RequiredDefaultvalue Description
searchByProperties No N/A Properties filter in this format:
"<propertyName>"<ops>’<propertyValue>’
Note: Property name and valueare case-sensitive.For example:
"IFTYPESTRING"=’ethernet-csmacd’
time No N/A Specific time values are asfollows:
v last-hour
v last-day
v last-week
v last-month
v last-year
Note: You need either start/endor time parameters in the URL.
start No N/A The start time for which flowdata must be returned.
end No N/A The end time for which flow datamust be returned.
excludeParent No false A flag to exclude the parent IDfrom response.
scope No
Yes forART/QoSmetrics
ibm-itnm
flow
Scope of the resource. Scope isrequired for ART, QoS relatedmetrics.
childTypes No * Comma-separated list of entitytypes of nodes that must befiltered in the result. By default,it is device and interface.Supported childTypes filtervalues are as follows:
v interface
v device
v probe
v physicalcard
v artTarget
v qosQueue
v * (All)
entityResourceTypes No N/A Entity type of node that must befiltered in result. For example:
v interface
v device
v probe
v physicalcard
v artTarget
v qosQueue
40 Network Performance Insight References
Name RequiredDefaultvalue Description
parentChildRelation No union Set operation between result fromparent ID search and entity IDsearch. For example, intersection,union.
Sample URLs/service/dataset/metric/lastValue?entities=ncim-217&metrics=snmpInBandwidth&start=1466008260000&end=1466011860000
/service/dataset/metric/lastValue?entities=ncim-217,ncim-218&metrics=snmpInBandwidth&time=last-hour
/service/dataset/metric/lastValue?entities=ncim-217&metrics=snmpInBandwidth&time=last-hour
/service/dataset/metric/lastValue?entities=ncim-217&metrics=snmpInBandwidth&start=1466008260000&end=1466011860000
/service/dataset/metric/lastValue?entityNames=T1 1/1,T1 1/2&metrics=snmpInBandwidth&start=1466008260000&end=1466011860000
/service/dataset/metric/lastValue?entities=ncim-217,ncim-218&metrics=snmpInBandwidth&time=last-hour
/service/dataset/metric/lastValue?metrics=snmpInBandwidth&time=lasthour&searchByProperties="PHYSICALADDRESS"=’30’ AND "LOCATION"=’KL’
/service/dataset/metric/lastValue?parents=3&metrics=snmpInBandwidth&time=lastday&childTypes=interface,device
Note:
v At least one or more of the following parameters must be provided as follows:– entities
– parents
– entityNames
– parentNames
– searchByProperties
– entityResourceTypes
v time or a combination of start AND or OR end must be provided.v time parameter is superseded by combination of start AND or OR end if both
combinations are present.v Supported operators for searchByProperties filter are as follows:
– ,– =– <>– IN– LIKE– AND– ORFor example:searchByProperties="sysName"=’"10.55.239.40"’ AND "If"=’897’searchByProperties="sysName"=’"10.55.239.40"’ AND "If" IN (’897’,’898’)searchByProperties="sysName" like ’"10.55.239.%25"’ AND "If"=’897’
Note: “%” is reserved keyword. It must be encoded with %25.
Chapter 1. REST API definitions 41
Error response
For example:{"errorMesg":"Either entities, parents, entityNames, parentNames or searchByPropertiesshould be provided"}
Response
The results are returned as JSON data that contains an array of the followingfields:
Name Data type Description
entity number The entity that is associated with thetime and metric value
parent number The parent entity ID associated withthe entity.
entityName string The entity name. This value isdefaulted as unknown if enrichmentfails.
parentName string The parent entity name. This value isdefaulted as unknown if enrichmentfails.
MetricValue map Map of metric given in inputparameters their values.
JSON code:[
{"parent":2,"entityName":"entity1","parentName":"parent2","health":10.0,"entity":1,"cpuUsage":10.0
},{
"parent":4,"entityName":"entity2","parentName":"parent4","health":10.0,"entity":2,"cpuUsage":10.0
}]
42 Network Performance Insight References
metricsProvides a list of metrics that are available for the specified entities and timeframe.
URL
This API queries and retrieves information from the ENTITY_METRIC.RAW table.http://[host]:[port]/service/dataset/metrics
http://<myserver.ibm.com>:8081/service/dataset/metrics
Method
The supported request type.HTTP GET
URL parameters
Name Required Default value Description
entities No N/A Comma-separated list of entityIDs
entityNames No N/A Comma-separated list of entitynames
parents No N/A Comma-separated list of mainnode IDs
parentNames No N/A Comma-separated list of ncimdevice names.Note: Must be associated withchildTypes for ART, QoS relatedmetrics.
searchByProperties No N/A Properties filter in this format:
"<propertyName>"<ops>’<propertyValue>’
Note: Property name and valueare case-sensitive.For example:
"IFTYPESTRING"=’ethernet-csmacd’
time No N/A Specific time values are asfollows:
v last-hour
v last-day
v last-week
v last-month
v last-year
Note: You need either start/endor time parameters in the URL.
start No N/A The start time for which flowdata must be returned.
end No N/A The end time for which flowdata must be returned.
excludeParent No false A flag to exclude the parent IDfrom response.
Chapter 1. REST API definitions 43
Name Required Default value Description
scope No
Yes forART/QoSmetrics
ibm-itnm
flow
Scope of the resource. Scope isrequired for ART, QoS relatedmetrics.
childTypes No * Comma-separated list of entitytypes of nodes that must befiltered in the result. By default,it is device and interface.Supported childTypes filtervalues are as follows:
v interface
v device
v probe
v physicalcard
v artTarget
v qosQueue
v * (All)
entityResourceTypes No N/A Entity Type of node that must befiltered in result. For example:
v interface
v device
v probe
v physicalcard
v artTarget
v qosQueue
parentChildRelation No union Set operation between resultfrom parent ID search and entityID search. For example,intersection, union.
Sample URLs/service/dataset/metrics?entities=ncim-217&start=1466008260000&end=1466011860000
/service/dataset/metrics?entities=ncim-217&time=last-hour
/service/dataset/metrics?entityNames=T1 1/1,T1 1/2&time=last-hour
/service/dataset/metrics?parents=3&time=last-month
/service/dataset/metrics?parents=3,1&entities=ncim-86,ncim-217&time=last-month
/service/dataset/metrics?parentNames=10.55.239.42,10.55.239.4&entityNames=T11/1&time=last-month
/service/dataset/metrics?time=last-month&="PHYSICALADDRESS"=’30’ AND "LOCATION"=’KL’
/service/dataset/metrics?parents=3&time=last-day&childTypes=interface
Note:
v At least one or more of the following parameters must be provided as follows:– entities
– parents
– entityNames
44 Network Performance Insight References
– parentNames
– entityResourceTypes
v time or a combination of start AND or OR end must be provided.v time parameter is superseded by combination of start AND or OR end if both
combinations are present.v Supported operators for searchByProperties filter are as follows:
– ,– =– <>– IN– LIKE– AND– ORFor example:searchByProperties="sysName"=’"10.55.239.40"’ AND "If"=’897’searchByProperties="sysName"=’"10.55.239.40"’ AND "If" IN (’897’,’898’)searchByProperties="sysName" like ’"10.55.239.%25"’ AND "If"=’897’
Note: “%” is reserved keyword. It must be encoded with %25.
Response
The results are returned as JSON data that contains an array of the followingfields:
Name Data type Description
metric string The metric name
metricID long The metric ID for the associated timeand metric value.
units string Unit of measurement for the metric.For example, #, %, undef
http://<myserver.ibm.com>:8081/service/dataset/metrics?entities=12,188&time=last-day&scope=ibm-itnm
JSON code:[
{"metric":"ifInDiscards","units":"#","metricId":2118
},{
"metric":"health","units":"undef","metricId":2119
},{
"metric":"snmpInBandwidth","units":"%","metricId":2120
}]
Chapter 1. REST API definitions 45
summaryProvides a summary of the metric data.
URL
This API queries and retrieves information from ENTITY_METRIC.RAW,ENTITY_METRIC.AGG_001DAY/AGG_006HR/ AGG_030MIN tables.http://[host]:[port]/service/dataset/metric/summary
http://<myserver.ibm.com>:8081/service/dataset/metric/summary
Method
The supported request type.HTTP GET
URL parameters
Name RequiredDefaultvalue Description
entities No N/A Comma-separated list of entityIDs.
entityNames No N/A Comma-separated list of entitynames.
metrics Yes N/A Comma-separated name of themetric expression that includes thetype of aggregation.
For example, snmpInBandwidth,health, max(health), min(health)
parents No N/A Comma-separated list of mainnode IDs.
parentNames No N/A Comma-separated list of ncimdevice names
searchByProperties No N/A Properties filter in this format:
"<propertyName>"<ops>’<propertyValue>’
Note: Property name and valueare case-sensitive.For example:
"IFTYPESTRING"=’ethernet-csmacd’
start No N/A The start time for which flow datamust be returned.
end No N/A The end time for which flow datamust be returned.Note: start and end parametersmust be used together.
46 Network Performance Insight References
Name RequiredDefaultvalue Description
time No N/A Specific time values:
v last-hour
v last-day
v last-week
v last-month
v last-year
Note: You need either start/endor time parameters in the URL.
sort No N/A Metric expression that defines thesort order of the records. Only onemetric is allowed with the sortexpression. Prefix + or - toindicate sort direction.
count No -1 Number of entities summary thatmust be returned. Combined withsort provides topN or bottomNfunctions.
page No 1 The index of the page for datadisplay. This parameter issupplied with count parameter toindicate page size. By default, it is1.
excludeParent No false Flag to exclude the parent ID fromthe result. By default, thisparameter is set to False.
scope No
Yes forART/QoSmetrics
ibm-itnm
flow
Scope of the resource. Scope isrequired for ART, QoS relatedmetrics.
childTypes No * Comma-separated list of entitytypes of nodes that must befiltered in the result. By default, itis device and interface. SupportedchildTypes filter values are asfollows:
v interface
v device
v probe
v physicalcard
v artTarget
v qosQueue
v * (All)
flatten No false Output of the result withoutnested the objects.
suppressSummary No N/A Output of the result without thesummary portion.
Chapter 1. REST API definitions 47
Name RequiredDefaultvalue Description
entityResourceTypes No N/A Entity Type of node that must befiltered in result. For example:
v interface
v device
v probe
v physicalcard
v artTarget
v qosQueue
parentChildRelation No union Set operation between the resultfrom parent identifier search andentity identifier search.
flowEnabled No false If set to true, the result mustcontain the flow enabled entities.
Sample URLs/service/dataset/metric/summary?entities=ncim-217&metrics=snmpInBandwidth&start=1466008260000&end=1466011860000
/service/dataset/metric/summary?entities=ncim-217,ncim-218&metrics=snmpInBandwidth&time=last-hour
/service/dataset/metric/summary?entities=ncim-217&metrics=snmpInBandwidth&time=last-hour
/service/dataset/metric/summary?entities=ncim-217&metrics=snmpInBandwidth&start=1466008260000&end=1466011860000
/service/dataset/metric/summary?entityNames=T1 1/1,T1 1/2&metrics=snmpInBandwidth&start=1466008260000&end=1466011860000
/service/dataset/metric/summary?parents=3&metrics=max(health),min(health),avg(health),sum(health),count(health)&time=last-month
/service/dataset/metric/summary?parents=3,4&entities=ncim-217,ncim-218&metrics=max(health),min(health),avg(health),sum(health),count(health)&time=last-month
/service/dataset/metric/summary?parents=3,4&entities=ncim-217,ncim-218&metrics=max(health),min(health),avg(health),sum(health),count(health)&time=last-month&sort=-sum(health)
/service/dataset/metric/summary?parents=3,4&entities=ncim-217,ncim-218&metrics=max(health),min(health),avg(health),sum(health),count(health)&time=last-month&sort=-sum(health)&count=10
/service/dataset/metric/summary?parentNames=10.55.239.42,10.55.239.4&entityNames=T11/1&metrics=max(health),min(health),avg(health),sum(health),count(health)&time=last-month&sort=-sum(health)&count=10
/service/dataset/metric/summary?entities=ncim-217,ncim-218&metrics=snmpInBandwidth&time=lasthour&page=2&count=10
/service/dataset/metric/summary?metrics=snmpInBandwidth&time=last-hour&page=2&count=10&searchByProperties="PHYSICALADDRESS"=’30’ AND "LOCATION"=’KL’
/service/dataset/metric/summary?parents=3&metrics=snmpInBandwidth&time=lastday&childTypes=interface,device/service/dataset/metric/summary?metrics=ifInDiscards&time=last-hour&entityResourceType=interface
/service/dataset/metric/summary?entities=ncim-138&metrics=max(ifInDiscards),sum(health),count(health)&time=last-hour&flatten=true
/service/dataset/metric/summary?entities=ncim-135&metrics=count(health)&time=lasthour&suppressSummary=true
/service/dataset/metric/summary?entities=ncim-138&metrics=max(ifInDiscards),sum(snmpInBandwidth),count(ifOutErrors)&time=lasthour&suppressSummary=false
/service/dataset/metric/summary?entities=ncim-135&metrics=count(health)&time=lasthour&parentChildRelation=[union/intersection]
Note:
v At least one or more of the following parameters must be provided:– entities
48 Network Performance Insight References
– parents
– entityNames
– parentNames
– searchByProperties
– entityResourceTypes
v time or a combination of start AND or OR end must be provided.v The start and end parameters must be used together. The time parameter
supersedes start and end if they are all present in the URL.v Supported operators for properties filter are as follows:
– ,– =– <>– IN– LIKE– AND– ORFor example:properties="IFADMINSTATUS"=’"up" AND "If"="897"properties="sysName"=’"10.55.239.40" AND "If" IN ("897","898")’properties="sysName" like ’"10.55.239.%25" AND "If"="897"
Note: “%” is reserved keyword. It must be encoded with %25.v count must be provided with sort.v metric used in the sort parameter must be in one of the expressions that is used
in metrics parameter.v When sort is not provided, output is sorted by entities and rank is shown as
zero.
Error response
For example:{"errorMesg":"Either entities, parents, entityNames, parentNames, entityResourceType orsearchByProperties should be provided"}{"errorMesg": "Invalid start, end and granularity combination. Granularity : 1 minute StartMs :1568373360000 endMs : 1468375200000"}
Response
The results are returned as JSON data that contains an array of the followingfields:
Name Data type Description
total number Total number of records available
page number Current page number
count number Number of records in the page
items list List of metric values. The entity that isassociated with the time and metricvalue.
Chapter 1. REST API definitions 49
Name Data type Description
entity number The entity that is associated with thetime and metric value.
parent number The entity that is associated with thetime and metric value.
entityName string The parent entity ID that is associatedwith the entity.
parentName string Parent entity name. This value isdefaulted to unknown, if enrichmentfails.
scope string Scope of the resource. For example,ibm-itnm or flow.
startTimestamp number The start time that is associated withthe metric value.
endTimestamp number The end time that is associated withthe metric value.
rank number The rank (1-N) of the record relative toall other entities based on sort.Defaults to 0 if sort parameter is notprovided.
metricValues list The list metric names and their values.
metric string The metric expression for theassociated time and metric value.
metricId long The metric ID for the associated timeand metric value.
value number The metric value for the associatedtime, entity, and metric expression.
inIfId number In interface IDs for given entities ifenriched.
outIfId number Out interface IDs for given entities ifenriched.
JSON code without suppressSummary flag set:{
"total":27,"page":1,"count":27,"items":[
{"entity":59,"scope":"ibm-itnm","startTimestamp":1469515500000,"endTimestamp":1469615500000,"rank":1,"metricValues":[
{"metric":"min(health)","metricId":2118,"value":0
},{
"metric":"max(health)","metricId":2118,"value":54
},
50 Network Performance Insight References
{"metric":"avg(health)","metricId":2118,"value":50
},{
"metric":"avg(snmpInBandwidth)","metricId":2119,"value":150
}]
},{
"entity":61,"scope":"ibm-itnm","startTimestamp":1469515500000,"endTimestamp":1469615500000,"rank":2,"metricValues":[
{"metric":"min(health)","metricId":2118,"value":0
},{
"metric":"max(health)","metricId":2118,"value":54
},{
"metric":"avg(health)","metricId":2118,"value":50
},{
"metric":"avg(snmpInBandwidth)","metricId":2119,"value":150
}]
}]
}
JSON code with suppressSummary flag set:[
{"entity":59,"scope":"ibm-itnm","startTimestamp":1469515500000,"endTimestamp":1469615500000,"rank":1,"metricValues":[
{"metric":"min(health)","metricId":2118,"value":0
},{
"metric":"max(health)","metricId":2118,"value":54
}]
}]
Chapter 1. REST API definitions 51
JSON code with flatten and suppressSummary flags set:{
"total":27,"page":1,"count":27,"items":[
{"entity":59,"scope":"ibm-itnm","startTimestamp":1469515500000,"endTimestamp":1469615500000,"rank":1,"min(health)":0,"max(health)":54,"avg(health)":50,"avg(snmpInBandwidth)":150
},{
"entity":61,"scope":"ibm-itnm","startTimestamp":1469515500000,"endTimestamp":1469615500000,"rank":2,"min(health)":54,"avg(health)":50,"avg(snmpInBandwidth)":150
}]
}
JSON code with flatten and flag set:[
{"entity":59,"scope":"ibm-itnm","startTimestamp":1469515500000,"endTimestamp":1469615500000,"rank":1,"min(health)":0,"max(health)":54
},{
"entity":61,"scope":"ibm-itnm","startTimestamp":1469515500000,"endTimestamp":1469615500000,"rank":2,"min(health)":54,"avg(health)":50,"avg(snmpInBandwidth)":150
}]
52 Network Performance Insight References
timeseriesProvides timeseries entity metric data.
URL
This API queries and retrieves information from ENTITY_METRIC.RAW,ENTITY_METRIC.AGG_001DAY/AGG_006HR/ AGG_030MIN tables.http://[host]:[port]/service/dataset/metric/timeseries
http://<myserver.ibm.com>:8081/service/dataset/metric/timeseries?entities=ncim-348&metrics=ifInDiscards&time=last-hour
Method
The supported request type.HTTP GET
URL parameters
Name RequiredDefaultvalue Description
entities No N/A Comma-separated list of entityIDs.
entityNames No N/A Comma-separated list of entitynames.
metrics Yes N/A Comma-separated list of metricsand their aggregation.
For example, snmpInBandwidth,health, max(health), min(health)
parents No N/A Comma-separated list of mainnode ID.
parentNames No N/A Comma-separated list of ncimdevice names
searchByProperties No N/A Properties filter in this format:
"<propertyName>"<ops>’<propertyValue>’
Note: Property name and valueare case-sensitive.For example:
"IFTYPESTRING"=’ethernet-csmacd’
start No N/A The start time for which flow datamust be returned.
end No N/A The end time for which flow datamust be returned.
time No N/A The name of the time short cut.For example:
v last-hour
v last-day
v last-week
v last-month
v last-year
Chapter 1. REST API definitions 53
Name RequiredDefaultvalue Description
granularity No N/A The granularity for which the datamust be aggregated. The defaultgranularity can be as follows:
v 1-minute
v 15-minute
v 30-minute
v 1-day
v 7-day
scope No
Yes forART/QoSmetrics
ibm-itnm
flow
Scope of the resource. Scope isrequired for ART, QoS relatedmetrics.
sort No N/A An expression that defines thesort order of the records. Prefix +or - to indicate sort direction. Forexample, +metric -upper_limitindicates that the sorting must beby metric in ascending order, andthen by upper_limit indescending order.
childTypes No * Comma-separated list of entitytypes of nodes that must befiltered in the result. By default, itis device and interface. SupportedchildTypes filter values are asfollows:
v interface
v device
v probe
v physicalcard
v artTarget
v qosQueue
v * (All)
excludeParent No N/A Flag to exclude the parent IDfrom the result. By default, thisparameter is set to False.
flatten No false Output of the result withoutnested the objects.
entityResourceTypes No N/A Entity Type of node that must befiltered in result. For example:
v interface
v device
v probe
v physicalcard
v artTarget
v qosQueue
54 Network Performance Insight References
Name RequiredDefaultvalue Description
parentChildRelation No union Set operation between result fromparent ID search and entity IDsearch. For example, intersection,union.
Sample URLs/service/dataset/metric/timeseries?entities=ncim-217&metrics=snmpInBandwidth&start=1466008260000&end=1466011860000
/service/dataset/metric/timeseries?entities=ncim-217&metrics=snmpInBandwidth&time=last-hour
/service/dataset/metric/timeseries?entities=ncim-217&metrics=snmpInBandwidth&time=lasthour&granularity=5-min
/service/dataset/metric/timeseries?entities=ncim-217&metrics=snmpInBandwidth&start=1466008260000&end=1466011860000&granularity=30-min
/service/dataset/metric/timeseries?entityNames=T1 1/1,T1 1/2&metrics=snmpInBandwidth&start=1466008260000&end=1466011860000&granularity=30-min
/service/dataset/metric/timeseries?parents=3&metrics=max(health),min(health),avg(health),sum(health),count(health)&time=last-month&granularity=30-min
/service/dataset/metric/timeseries?parents=3&entities=ncim-86&metrics=max(health),min(health),avg(health),sum(health),count(health)&time=last-month
/service/dataset/metric/timeseries?parentNames=10.55.239.42,10.55.239.4&entityNames=T11/1&metrics=max(health),min(health),avg(health),sum(health),count(health)&time=last-month
/service/dataset/metric/timeseries?metrics=max(health),min(health),avg(health),sum(health),count(health)&time=last-month&serachByProperties="PHYSICALADDRESS"=’30’ AND "LOCATION"=’KL’
/service/dataset/metric/timeseries?parents=3&metrics=snmpInBandwidth&time=lastday&childTypes=interface,device
Note:
v At least one or more of the following parameters must be provided as follows:– entities
– parents
– entityNames
– parentNames
– searchByProperties
– entityResourceTypes
v time or a combination of start and end or start or end must be provided.v Sort by metric, entitities, and timestamp are only supported.v The start and end parameters must be used together. The time parameter
supersedes start and end if they are all present in the URL.v time parameter is superseded by combination of start AND or OR end.v Supported operators for properties filter are as follows:
– ,– =– <>– IN– LIKE– AND– ORFor example:
Chapter 1. REST API definitions 55
searchByProperties="sysName"=’"10.55.239.40"’ AND "If"=’897’searchByProperties="sysName"=’"10.55.239.40"’ AND "If" IN (’897’,’898’)searchByProperties="sysName" like ’"10.55.239.%25"’ AND "If"=’897’
Note: “%” is reserved keyword. It must be encoded with %25.v If granularity is not provided, it is computed as follows:
– If time range is <= 3 hours, granularity = 1 minute.– If time range is >3 hour and <=12 hour, granularity = 15 minutes.– If time range is >12 hour and <=7 days, granularity = 30 minutes.– If time range is between 7 and <90 days, granularity = 1 day.– If time range is >=90 days, granularity = 7days.
v When the parents or parentNames and entities or entityNames are used in thesame URL and the parentChildRelation I is equal to intersection, the result isrelated to the specific parent and entity. By default, the relation is union, anddisplays all the parents and entities.
Special behavior
When you specify a granularity period with a start and end time in your query,the API engine always returns the data from the next available round up time. Forexample, if you give a query as follows:http://<myserver.ibm.com>:8081/service/dataset/metric/timeseries?entities=43064,188&metrics=ifInDiscards&start=1497052800000&end=1497117600000&granularity=18-hours
The start time is calculated based on the aggregation round up time. For 18-hrsgranularity, the round up aggregation times for the start time of June 10, 201712:00:00 AM are:v June 9, 2017 12:00:00 PMv June 10, 2017 6:00:00 AMv June 11, 2017 12:00:00 AM
The query returns the aggregated data from next available round up time that isJune 10, 2017 6:00:00 AM and not from June 10, 2017 12:00:00 AM.
Note: This behavior is noticed with timeseries API only.
Error response
For example:{"errorMesg":"Either entities, parents, entityNames, parentNames or serachByProperties should be provided"}{"errorMesg": "Invalid start, end and granularity combination. Granularity : 1 minute StartMs : 1568373360000endMs : 1468375200000"}}
Response
The results are returned as JSON data that contains an array of the followingfields:
Name Data type Description
entity number The entity that is associatedwith the time and metricvalue.
56 Network Performance Insight References
Name Data type Description
parent number The parent entity ID that isassociated with the entity.
entityName string The entity name. The valueis defaulted to unknown ifenrichment fails.
parentName string The entity’s parent name.The value is defaulted tounknown if enrichment fails.
scope string Scope of the resource that isibm-itnm.
metric string The metric name for theassociated time and metricvalue
metricId long The metric ID for theassociated time and metricvalue.
timestamp number The time that is associatedwith the metric value.
value number The metric value for theassociated time
JSON code without flatten parameter set:[
{"parent":6,"timestamp":1471503616000,"entityName":"0","parentName":"10.55.239.2","scope":"ibm-itnm","metric":"ifOutErrors","metricId":2118,"entity":86,"value":5398
},{
"parent":-1,"timestamp":1471501946000,"entityName":"unknown","parentName":"unknown","scope":"ibm-itnm","metric":"ifOutErrors","metricId":2118,"entity":134,"value":40
},{
"parent":8,"timestamp":1471501956000,"entityName":"T1 1/2","parentName":"10.55.239.4","scope":"ibm-itnm","metric":"ifOutErrors","metricId":2118,"entity":114,"value":0
}]
Chapter 1. REST API definitions 57
JSON code with flatten parameter set:[
{"parent":587,"timestamp":1506250800000,"scope":"ibm-itnm","entityName":"0","parentName":"10.55.239.31","AVG(ifInDiscards)":6,"entity":607,"SUM(ifInDiscards)":6
},{
"parent":587,"timestamp":1506258000000,"scope":"ibm-itnm","entityName":"0","parentName":"10.55.239.31","AVG(ifInDiscards)":6,"entity":607,"SUM(ifInDiscards)":6
}]
Threshold APIREST APIs that define entity metric Thresholds and stores Threshold definitions.
definitionRetrieves and stores the threshold definitions.
It performs the following functions:v Get all the stored threshold definitionsv Get a single definition based on an identifierv Stores a definition
URL
With this API, information is queried and retrieved fromTHRESHOLD.STATIC_DEFINITION table. It can also store a new thresholddefinition in the table.http://[host]:[port]/service/dataset/threshold/definition
http://<myserver.ibm.com>:8081/service/dataset/threshold/definition
Method
The supported request type.HTTP GETHTTP POST/PUT
URL parameters
Name Required Description
query No Provides a query predicate, which is a filter that isapplied to a where clause.
fields No Specifies the wanted fields in the response
58 Network Performance Insight References
Name Required Description
count No Specifies the wanted maximum number of rows inthe response
sort No How the records must be sorted. Prefix + or - toindicate sort direction. For example, +metric,-upper_limit indicates to sort by metric inascending order, and then sort by upper_limit indescending order.
Sample URL
Get Allhttp://<myserver.ibm.com>:8081/service/dataset/threshold/definition
Get one (Query by an identifier)http://<myserver.ibm.com>:8081/service/dataset/threshold/definition?query=threshold_id=2
Post or Puthttp://<myserver.ibm.com>:8081/service/dataset/threshold/definition
Response
The results are returned as JSON data that contains an array of the followingfields:
Name Data type Description Example
metric string The metric name snmpInBandwidth
effective_time_stamp long Most recent timewhen the staticdefinition is stored orupdated.
UNIX epoch timewith millisecondprecision
threshold_id long Unique identifier forthe thresholddefinition
2Important: Whenyou post a thersholddefinition for IP SLAdata, alwaysuse threshold_id =0.
enabled boolean Indicates whether thethreshold definitionis active or not.
true or false
limit_type int How the staticthreshold ranges areto be applied.
v 0 is Over
v 1 is Under
v 2 is Band
upper_limit long Upper range limit 1000
lower_limit long Lower range limit 100
num_events int Number ofconsecutiveoccurrences that arerequired to violate athreshold.
4
Get response
Chapter 1. REST API definitions 59
[{
"metric":"snmpInBandwidth","effective_time_stamp":1469199999999,"threshold_id":1,"enabled":true,"limit_type":2,"upper_limit":400000,"lower_limit":330000,"num_events":5
},{
"metric":"snmpOutBandwidth","effective_time_stamp":1469199999999,"threshold_id":2,"enabled":true,"limit_type":2,"upper_limit":400000,"lower_limit":330000,"num_events":5
},{
"metric":"ifInErrors","effective_time_stamp":1469199999999,"threshold_id":3,"enabled":true,"limit_type":0,"upper_limit":1000,"lower_limit":250,"num_events":2
},{
"metric":"ifOutErrors","effective_time_stamp":1469199999999,"threshold_id":4,"enabled":true,"limit_type":0,"upper_limit":200,"lower_limit":50,"num_events":2
}]
Payload for Post{
"metric":"snmpInBandwidth","effective_time_stamp":1469199999999,"threshold_id":2,"enabled":true,"limit_type":2,"upper_limit":400000,"lower_limit":330000,"num_events":6
}
Payload for Post for IP SLA data{"metric":"httpRtt,
"effective_time_stamp":1470275112000,"threshold_id":0,"enabled":true,"limit_type":2,"upper_limit":50,"lower_limit":10,"num_events":2
}
60 Network Performance Insight References
Attention: The threshold_id must be a unique number for that metric. Check theTHRESHOLD.STATIC_DEFINITION table for the existing threshold IDs. If you donot specify a unique ID the existing metric with the same ID is updated and thenew threshold definition is not created for the metric.
Chapter 1. REST API definitions 61
62 Network Performance Insight References
Chapter 2. Command line interface
Provide command-line interfaces that are available in IBM Network PerformanceInsight to support installation, configuration, administration, and other tasks.
A list of commands available for Network Performance Insight users andadministrators.
basecamp-manager-cmd command referenceUsage for the basecamp-manager-cmd command. The basecamp-manager-cmdcommand is available after the Fix Pack 1 is applied. Run the basecamp-manager-cmd command to start, stop, and check the status of Network Performance Insightservices.
Location
Note: basecamp-manager-cmd command can be run as netcool or a non-root userwith sudo permissions to control Network Performance Insight services.
<basecamp_Home>/basecamp-manager/bin
<basecamp_Home> is the location where the generic basecamp packages are installed.For example, /opt/IBM/basecamp.
basecamp-manager-cmd command syntax
►► basecamp-manager-cmd action stop service npi-formula hoststart npi-thresholdstatus npi-event
npi-snmp-collectornpi-itnm-collectornpi-flow-collectornpi-flow-analyticsnpi-entity-analyticsnpi-dns
►◄
basecamp-manager-cmd {action[stop|start|status] | -service <service_name> |-host <hostname>}
Parameters
serviceSpecify the name of the service. For example:v npi-formula
v npi-threshold
v npi-event
v npi-snmp-collector
v npi-flow-analytics
v npi-itnm-collector
v npi-flow-collector
v npi-dns
© Copyright IBM Corp. 2015, 2018 63
hostFully qualified host name (FQDN) where the service is located.
actionstop
Stops the specified service.
startStart the specified service.
statusChecks the status of the specified service.
Note: You can check the status only when the Manager Service is up andrunning.
For example:
To start the Flow Collector Service:/opt/IBM/basecamp/basecamp-manager/bin/basecamp-manager-cmd -service npi-flow-collector -host <myserver.ibm.com> start
To display the status of all services on all hosts:/opt/IBM/basecamp/basecamp-manager/bin/basecamp-manager-cmd status
To display the status of all services on a particular host as non-root user:sudo /opt/IBM/basecamp/basecamp-manager/bin/basecamp-manager-cmd -host <myserver.ibm.com> status
backup command referenceUsage for the backup command. Run the backup command to back up NetworkPerformance Insight storage database. Starting from Fix Pack 1, the backupcommand location is changed.
Location
Note: backup command can be run as root or netcool user with sudo permissionsto control Network Performance Insight services.
<basecamp_Home>/basecamp-storage/bin
<basecamp_Home> is the location where the basecamp packages are installed. Forexample, /opt/IBM/basecamp.
backup command syntax
►► backuppath
toolhelp
►◄
backup {-path <local directory>|-tool <backup tool script location> |-help}
Parameters
pathThe directory path of where the backup tar files are stored.
64 Network Performance Insight References
toolThe full path of where the Customized_script is located. For example:<basecamp_Home>/basecamp-storage/bin/directory/Customized_script
By default, this option uses the <basecamp_Home>/basecamp-storage/bin/backup-tool script to create tar files to the path specified in -path.
helpDisplays the usage for backup command.
restore command referenceUsage for the restore command. Run the restore command to restore NetworkPerformance Insight storage database. Starting from Fix Pack 1, the restorecommand location is changed.
Location
Note: restore command can be run as root or netcool user with sudo permissionsto control Network Performance Insight services.
<basecamp_Home>/basecamp-storage/bin
<basecamp_Home> is the location where Network Performance Insight is installed.For example, /opt/IBM/basecamp.
restore command syntax
►► restorelocalBackuphelp
►◄
restore {-localBackup <backup tarball location> | -help}
Parameters
-localBackupThe directory path of where the backup tar files to be restored from.
-helpDisplays the usage for restore command.
Chapter 2. Command line interface 65
66 Network Performance Insight References
Chapter 3. NetFlow versions
NetFlow technology can collect IP network traffic as it enters or exits an interface.
NetFlow enabled devices can export IP traffic statistics from all interfaces asNetFlow records to be collected by one or more associated NetFlow collectors.
The device emits a flow record when it determines that the Flow is finished byusing Flow aging, that is, when the device sees new traffic for an existing Flow, itresets the aging counter. The aging counter is determined by Flow active andinactive timeout. Typically, NetFlow records are exported by using UDP. Somemodern implementations of NetFlow use the Stream Control Transmission Protocol(SCTP) to export packets to provide some protection against packet loss, and tomake sure that NetFlow v9 templates are received before any related record isexported.
The different Flow versions that are supported in Netcool Operations Insight suchas:v NetFlow V1
First implementation of Cisco, which is now obsolete, and restricted to IPv4only.
v NetFlow V5Most common version, available on many routers from different brands.
v NetFlow V9Template-based Flow. Mostly used to report Flows like IPv6, MPLS, or evenplain IPv4 with BGP nexthop.
v IPFIXBased on the NetFlow Version 9 implementation, IPFIX is on the IETF standardsand can be implemented by multiple vendors.
NetFlow V1 formatsV1 format is the original format that is supported in the initial NetFlow releases.
V1 header format
Bytes Contents Description
0-1 version NetFlow export formatversion number
2-3 count Number of flows that areexported in this packet (1-24)
4-7 SysUptime Current time in millisecondssince the export device isstarted
8-11 unix_secs Current count of secondssince 0000 CoordinatedUniversal Time 1970
12-16 unix_nsecs Residual nanoseconds since0000 Coordinated UniversalTime 1970
© Copyright IBM Corp. 2015, 2018 67
V1 Flow record format
Bytes Contents Description
0-3 srcaddr Source IP address
4-7 dstaddr Destination IP address
8-11 nexthop IP address of next hop router
12-13 input SNMP index of inputinterface
14-15 output SNMP index of outputinterface
16-19 dPkts Packets in the flow
20-23 dOctets Total number of Layer 3bytes in the packets of theflow
24-27 First SysUptime at start of flow
28-31 Last SysUptime at the time thelast packet of the flow wasreceived
32-33 srcport TCP/UDP source portnumber or equivalent
34-35 dstport TCP/UDP destination portnumber or equivalent
36-37 pad1 Unused (zero) byte
38 prot IP protocol type (forexample, TCP = 6; UDP = 17)
39 tos IP type of service (ToS)
40 flags Cumulative OR of TCP flags
41-43 pad1pad2pad3
Unused (zero) bytes
44-48 Reserved Unused (zero) bytes
Related information:
NetFlow Export Datagram Format
NetFlow V5 formatsV5 format is an enhancement that adds Border Gateway Protocol (BGP)autonomous system information and flow sequence numbers.
V5 header format
Bytes Fields Description
0-1 version NetFlow export formatversion number
2-3 count Number of flows that areexported in this packet (1-30)
68 Network Performance Insight References
Bytes Fields Description
4-7 SysUptime Current time in millisecondssince the export devicestarted
8-11 unix_secs Current count of secondssince 0000 CoordinatedUniversal Time 1970
12-15 unix_nsecs Residual nanoseconds since0000 Coordinated UniversalTime 1970
16-19 flow_sequence Sequence counter of totalflows seen
20 engine_type Type of flow-switchingengine
21 engine_id Slot number of theflow-switching engine
22-23 sampling_interval First two bits hold thesampling mode; remaining14 bits hold value ofsampling interval
V5 Flow record format
Bytes Fields Description
0-3 srcaddr Source IP address
4-7 dstaddr Destination IP address
8-11 nexthop IP address of next hop router
12-13 input SNMP index of inputinterface
14-15 output SNMP index of outputinterface
16-19 dPkts Packets in the flow
20-23 dOctets Total number of Layer 3bytes in the packets of theflow
24-27 First SysUptime at start of flow
28-31 Last SysUptime at the time thelast packet of the flow wasreceived
32-33 srcport TCP/UDP source portnumber or equivalent
34-35 dstport TCP/UDP destination portnumber or equivalent
36 pad1 Unused (zero) byte
37 tcp_flags Cumulative OR of TCP flags
38 prot IP protocol type (forexample, TCP = 6; UDP = 17)
39 tos IP type of service (ToS)
Chapter 3. NetFlow versions 69
Bytes Fields Description
40-41 src_as Autonomous system numberof the source, either origin orpeer
42-43 dst_as Autonomous system numberof the destination, eitherorigin or peer
44 src_mask Source address prefix maskbits
45 dst_mask Destination address prefixmask bits
46-47 pad2 Unused (zero) bytes
Related information:
NetFlow Export Datagram Format
V9 field type definitionsWhen extensibility is required, the new field types can be added to the list. Thenew field types must be updated on the Exporter and Collector but the NetFlowexport format remains unchanged.
Field Type Value Length (bytes) Description
IN_BYTES 1 N (default is 4)Incoming counter with length N x8 bits for number of bytesassociated with an IP Flow.
IN_PKTS 2 N (default is 4)
Incoming counter with length N x8 bits for the number of packetsthat are associated with an IPFlow
FLOWS 3 NNumber of flows that areaggregated; default for N is 4
PROTOCOL 4 1 IP protocol byte
SRC_TOS 5 1Type of Service byte setting whenthere is an incoming interface
TCP_FLAGS 6 1Cumulative of all the TCP flagsseen for this flow
L4_SRC_PORT 7 2TCP/UDP source port number.That is, FTP, Telnet, or equivalent
IPV4_SRC_ADDR 8 4 IPv4 source address
SRC_MASK 9 1
The number of contiguous bits inthe source address subnet mask.That is, the submask in slashnotation
INPUT_SNMP 10 NInput interface index; default forN is 2 but higher values might beused
L4_DST_PORT 11 2TCP/UDP destination portnumber. That is, FTP, Telnet, orequivalent
IPV4_DST_ADDR 12 4 IPv4 destination address
70 Network Performance Insight References
Field Type Value Length (bytes) Description
DST_MASK 13 1
The number of contiguous bits inthe destination address subnetmask. That is, the submask inslash notation.
OUTPUT_SNMP 14 NOutput interface index; default forN is 2 but higher values might beused
IPV4_NEXT_HOP 15 4 IPv4 address of next-hop router
SRC_AS 16 N (default is 2)Source BGP autonomous systemnumber where N might be 2 or 4
DST_AS 17 N (default is 2)Destination BGP autonomoussystem number where N might be2 or 4
BGP_IPV4_NEXT_HOP 18 4Next-hop router's IP in the BGPdomain
MUL_DST_PKTS 19 N (default is 4)
IP multicast outgoing packetcounter with length N x 8 bits forpackets that are associated withthe IP Flow
MUL_DST_BYTES 20 N (default is 4)IP multicast outgoing byte counterwith length N x 8 bits for bytesassociated with the IP Flow
LAST_SWITCHED 21 4System uptime at which the lastpacket of this flow was switched
FIRST_SWITCHED 22 4System uptime at which the firstpacket of this flow was switched
OUT_BYTES 23 N (default is 4)Outgoing counter with length N x8 bits for the number of bytesassociated with an IP Flow
OUT_PKTS 24 N (default is 4)
Outgoing counter with length N x8 bits for the number of packetsthat are associated with an IPFlow.
MIN_PKT_LNGTH 25 2Minimum IP packet length onincoming packets of the flow
MAX_PKT_LNGTH 26 2Maximum IP packet length onincoming packets of the flow
IPV6_SRC_ADDR 27 16 IPv6 Source Address
IPV6_DST_ADDR 28 16 IPv6 Destination Address
IPV6_SRC_MASK 29 1Length of the IPv6 source mask incontiguous bits
IPV6_DST_MASK 30 1Length of the IPv6 destinationmask in contiguous bits
IPV6_FLOW_LABEL 31 3IPv6 flow label as in RFC 2460definition
ICMP_TYPE 32 2Internet Control Message Protocol(ICMP) packet type; reported as((ICMP Type*256) + ICMP code)
MUL_IGMP_TYPE 33 1Internet Group ManagementProtocol (IGMP) packet type
Chapter 3. NetFlow versions 71
Field Type Value Length (bytes) Description
SAMPLING_INTERVAL 34 4
During the use of sampledNetFlow, the rate at which packetsare sampled. That is, a value of100 indicates that one of every 100packets is sampled
SAMPLING_ALGORITHM 35 1
The type of algorithm that is usedfor sampled NetFlow: 0x01Deterministic Sampling, 0x02Random Sampling
FLOW_ACTIVE_TIMEOUT 36 2Timeout value (in seconds) foractive flow entries in the NetFlowcache
FLOW_INACTIVE_TIMEOUT 37 2Timeout value (in seconds) forinactive flow entries in theNetFlow cache
ENGINE_TYPE 38 1Type of flow switching engine: RP= 0, VIP/Linecard = 1
ENGINE_ID 39 1ID number of the flow switchingengine
TOTAL_BYTES_EXP 40 N (default is 4)
Counter with length N x 8 bits forbytes for the number of bytesexported by the ObservationDomain
TOTAL_PKTS_EXP 41 N (default is 4)
Counter with length N x 8 bits forbytes for the number of packetsthat are exported by theObservation Domain
TOTAL_FLOWS_EXP 42 N (default is 4)
Counter with length N x 8 bits forbytes for the number of flows thatare exported by the ObservationDomain
*Vendor Proprietary* 43
IPV4_SRC_PREFIX 44 4IPv4 source address prefix(specific for Catalyst architecture)
IPV4_DST_PREFIX 45 4IPv4 destination address prefix(specific for Catalyst architecture)
MPLS_TOP_LABEL_TYPE 46 1
MPLS Top Label Type: 0x00UNKNOWN 0x01 TE-MIDPT 0x02ATOM 0x03 VPN 0x04 BGP 0x05LDP
MPLS_TOP_LABEL_IP_ADDR 47 4Forwarding Equivalent Classcorresponding to the MPLS TopLabel
FLOW_SAMPLER_ID 48 1Identifier that is shown in "showflow-sampler"
FLOW_SAMPLER_MODE 49 1
The type of algorithm that is usedfor sampling data: 0x02 randomsampling. Use withFLOW_SAMPLER_MODE
FLOW_SAMPLER_RANDOM_INTERVAL50 4Packet interval at which tosample. Use withFLOW_SAMPLER_MODE
72 Network Performance Insight References
Field Type Value Length (bytes) Description
*Vendor Proprietary* 51
MIN_TTL 52 1Minimum TTL on incomingpackets of the flow
MAX_TTL 53 1Maximum TTL on incomingpackets of the flow
IPV4_IDENT 54 2 The IP v4 that identifies field
DST_TOS 55 1Type of Service byte setting whenexiting outgoing interface
IN_SRC_MAC 56 6 Incoming source MAC address
OUT_DST_MAC 57 6Outgoing destination MACaddress
SRC_VLAN 58 2Virtual LAN identifier that isassociated with ingress interface
DST_VLAN 59 2Virtual LAN identifier that isassociated with egress interface
IP_PROTOCOL_VERSION 60 1
Internet Protocol version is set to4 for IPv4, and set to 6 for IPv6. Ifnot present in the template, thenversion 4 is assumed.
DIRECTION 61 1Flow direction: 0 - ingress flow, 1- egress flow
IPV6_NEXT_HOP 62 16IPv6 address of the next-hoprouter
BPG_IPV6_NEXT_HOP 63 16Next-hop router in the BGPdomain
IPV6_OPTION_HEADERS 64 4Bit-encoded field that identifiesIPv6 option headers found in theflow
Vendor Proprietary 65
Vendor Proprietary 66
Vendor Proprietary 67
Vendor Proprietary 68
Vendor Proprietary 69
MPLS_LABEL_1 70 3
MPLS label at position 1 in thestack. It comprises 20 bits ofMPLS label, 3 EXP (experimental)bits and 1 S (end-of-stack) bit.
MPLS_LABEL_2 71 3
MPLS label at position 2 in thestack. It comprises 20 bits ofMPLS label, 3 EXP (experimental)bits and 1 S (end-of-stack) bit.
MPLS_LABEL_3 72 3
MPLS label at position 3 in thestack. It comprises 20 bits ofMPLS label, 3 EXP (experimental)bits and 1 S (end-of-stack) bit.
MPLS_LABEL_4 73 3
MPLS label at position 4 in thestack. It comprises 20 bits ofMPLS label, 3 EXP (experimental)bits and 1 S (end-of-stack) bit.
Chapter 3. NetFlow versions 73
Field Type Value Length (bytes) Description
MPLS_LABEL_5 74 3
MPLS label at position 5 in thestack. It comprises 20 bits ofMPLS label, 3 EXP (experimental)bits and 1 S (end-of-stack) bit.
MPLS_LABEL_6 75 3
MPLS label at position 6 in thestack. It comprises 20 bits ofMPLS label, 3 EXP (experimental)bits and 1 S (end-of-stack) bit.
MPLS_LABEL_7 76 3
MPLS label at position 7 in thestack. It comprises 20 bits ofMPLS label, 3 EXP (experimental)bits and 1 S (end-of-stack) bit.
MPLS_LABEL_8 77 3
MPLS label at position 8 in thestack. It comprises 20 bits ofMPLS label, 3 EXP (experimental)bits and 1 S (end-of-stack) bit.
MPLS_LABEL_9 78 3
MPLS label at position 9 in thestack. It comprises 20 bits ofMPLS label, 3 EXP (experimental)bits and 1 S (end-of-stack) bit.
MPLS_LABEL_10 79 3
MPLS label at position 10 in thestack. It comprises 20 bits ofMPLS label, 3 EXP (experimental)bits and 1 S (end-of-stack) bit.
IN_DST_MAC 80 6Incoming destination MACaddress
OUT_SRC_MAC 81 6 Outgoing source MAC address
IF_NAME 82
N
Shortened interface name, FE1/0(default that isspecified intemplate)
IF_DESC 83N (default thatis specified intemplate)
Full interface name, FastEthernet1/0
SAMPLER_NAME 84N (default thatis specified intemplate)
Name of the flow sampler
IN_ PERMANENT _BYTES 85 N (default is 4)Running byte counter for apermanent flow
IN_ PERMANENT _PKTS 86 N (default is 4)Running packet counter for apermanent flow
* Vendor Proprietary* 87
FRAGMENT_OFFSET 88 2The fragment-offset value fromfragmented IP packets
74 Network Performance Insight References
Field Type Value Length (bytes) Description
FORWARDING STATUS 89 1
Forwarding status is encoded on 1byte with the 2 left bits giving thestatus and the 6 remaining bitsgiving the reason code.
Status is either unknown (00),Forwarded (10), Dropped (10) orConsumed (11). List of forwardingstatus values with their meanings:
v Unknown
– 0
v Forwarded
– Unknown 64
– Forwarded Fragmented 65
– Forwarded not Fragmented66
v Dropped
– Unknown 128
– Drop ACL Deny 129
– Drop ACL drop 130
– Drop Unroutable 131
– Drop Adjacency 132
– Drop Fragmentation and DFset 133
– Drop Bad header checksum134
– Drop Bad total Length 135
– Drop Bad Header Length 136
– Drop bad TTL 137
– Drop Policer 138
– Drop WRED 139
– Drop RPF 140
– Drop For us 141
– Drop Bad output interface142
– Drop Hardware 143
v Consumed
– Unknown 192
– Terminate Punt Adjacency193
– Terminate IncompleteAdjacency 194
– Terminate For us 195
MPLS PAL RD 90 8 (array) MPLS PAL Route Distinguisher.
Chapter 3. NetFlow versions 75
Field Type Value Length (bytes) Description
MPLS PREFIX LEN 91 1Number of consecutive bits in theMPLS prefix length.
SRC TRAFFIC INDEX 92 4BGP Policy Accounting SourceTraffic Index
DST TRAFFIC INDEX 93 4BGP Policy AccountingDestination Traffic Index
APPLICATION DESCRIPTION 94 N Application description.
APPLICATION TAG 95 1+n8 bits of engine ID, followed by nbits of classification.
APPLICATION NAME 96 NName that is associated with aclassification.
postipDiffServCodePoint 98 1
The value of a DifferentiatedServices Code Point (DSCP)encoded in the DifferentiatedServices field after modification.
replication factor 99 4 Multicast replication factor.
DEPRECATED 100 N DEPRECATED
layer2packetSectionOffset 102Layer 2 packet section offset.Potentially a generic offset.
layer2packetSectionSize 103Layer 2 packet section size.Potentially a generic size.
layer2packetSectionData 104 Layer 2 packet section data.
105 - 127 Reserved for future use by cisco
Related information:
NetFlow Version 9 Flow-Record Format
Normalized Flow record fields in Network Performance InsightA list of normalized flow fields that are used with a common label across all flowformats and applicable for all vendors and protocols.
When you enable the configuration setting as described in Enabling additional Flowraw fields collection section in Installing and Configuring IBM Network PerformanceInsight to collect all Flow fields, all the fields that are specified in the table arecollected. The list of Flow fields that are stored in the database is specified inDefault normalized flow record fields in Network Performance Insight section in IBMNetwork Performance Insight: Product Overview. The remaining Flow fields are storedin Hadoop file system and can be read by using an Apache Parquet reader.
Normalized Flow Fields V9 Field name IPFIX field name
inOctets 1(IN_BYTES) 1(octetDeltaCount)
inPackets 2(IN_PKTS) 2(packetDeltaCount)
deltaFlowCount 3(FLOWS) 3(deltaFlowCount)
protocolId 4(PROTOCOL) 4(protocolIdentifier)
srcTos 5(SRC_TOS) 5(ipClassOfService)
tcpBits 6(TCP_FLAGS) 6(tcpControlBits)
srcPort 7(L4_SRC_PORT) 7(sourceTransportPort)
76 Network Performance Insight References
Normalized Flow Fields V9 Field name IPFIX field name
srcIp 8(IPV4_SRC_ADDR) 8(sourceIPv4Address)
srcMask 9(SRC_MASK) 9(sourceIPv4PrefixLength)
inIfId 10(INPUT_SNMP) 10(ingressInterface)
dstPort 11(L4_DST_PORT) 11(destinationTransportPort)
dstIp 12(IPV4_DST_ADDR) 12(destinationIPv4Address)
dstMask 13(DST_MASK) 13(destinationIPv4PrefixLength)
outIfId 14(OUTPUT_SNMP) 14(egressInterface)
nextHopIp 15(IPV4_NEXT_HOP) 15(ipNextHopIPv4Address)
bgpSrcAsNum 16(SRC_AS) 16(bgpSourceAsNumber)
bgpDstAsNum 17(DST_AS) 17(bgpDestinationAsNumber)
bgpNextHopIp 18(BGP_IPV4_NEXT_HOP) 18(bgpNextHopIPv4Address)
postMCastPacketDeltaCount MUL_DST_PKTS 19(postMCastPacketDeltaCount)
postMCastOctetDeltaCount MUL_DST_BYTES 20(postMCastOctetDeltaCount)
endMs =baseTimestamp+21(LAST_SWITCHED) 21(flowEndSysUpTime)
startMs =baseTimestamp+22(FIRST_SWITCHED)22(flowStartSysUpTime)
outOctets 23(OUT_BYTES) 23(postOctetDeltaCount)
outPackets 24(OUT_PKTS) 24(postPacketDeltaCount)
minimumIpTotalLength MIN_PKT_LNGTH 25(minimumIpTotalLength)
maximumIpTotalLength MAX_PKT_LNGTH 26(maximumIpTotalLength)
srcIp 27(IPV6_SRC_ADDR) 27(sourceIPv6Address)
dstIp (28(IPV6_DST_ADDR) 28(destinationIPv6Address)
srcMask 29(IPV6_SRC_MASK) 29(sourceIPv6PrefixLength)
dstMask 30(IPV6_DST_MASK) 30(destinationIPv6PrefixLength)
flowLabelIPv6 31(IPV6_FLOW_LABEL) 31(flowLabelIPv6)
icmpTypeCodeIPv4 32(ICMP_TYPE) 32(icmpTypeCodeIPv4)
igmpType 33(MUL_IGMP_TYPE) 33(igmpType)
samplingInterval 34(SAMPLING_INTERVAL) 34(samplingInterval)
samplingAlgorithm 35(SAMPLING_ALGORITHM) 35(samplingAlgorithm)
flowActiveTimeout 36(FLOW_ACTIVE_TIMEOUT) 36(flowActiveTimeout)
flowIdleTimeout 37(FLOW_INACTIVE_TIMEOUT) 37(flowIdleTimeout)
engineType 38(ENGINE_TYPE) 38(engineType)
engineId 39(ENGINE_ID) 39(engineId)
exportedOctetTotalCount 40(TOTAL_BYTES_EXP) 40(exportedOctetTotalCount)
exportedMessageTotalCount 41(TOTAL_PKTS_EXP) 41(exportedMessageTotalCount)
exportedFlowRecordTotalCount 42(TOTAL_FLOWS_EXP) 42(exportedFlowRecordTotalCount)
ipv4RouterSc 43(*Vendor Proprietary*) 43(ipv4RouterSc)
sourceIPv4Prefix 44(IPV4_SRC_PREFIX) 44(sourceIPv4Prefix)
destinationIPv4Prefix 45(IPV4_DST_PREFIX) 45(destinationIPv4Prefix)
mplsTopLabelType 46(MPLS_TOP_LABEL_TYPE) 46(mplsTopLabelType)
mplsTopLabelIPv4Address 47(MPLS_TOP_LABEL_IP_ADDR) 47(mplsTopLabelIPv4Address)
samplerId 48(FLOW_SAMPLER_ID) 48(samplerId)
Chapter 3. NetFlow versions 77
Normalized Flow Fields V9 Field name IPFIX field name
samplerMode 49(FLOW_SAMPLER_MODE) 49(samplerMode)
samplerRandomInterval 50(FLOW_SAMPLER_RANDOM_INTERVAL)
50(flow_sampler_randomInterval)
classId 51(classId) 51(classId)
minimumTTL 52(MIN_TTL) 52(minTtl)
maximumTTL 53(MAX_TTL) 53(maxTtl)
fragmentIdentification 54(IPV4_IDENT) 54(sourceIPv6PrefixLength)
postIpClassOfService 55(DST_TOS) 55(postIpClassOfService)
sourceMacAddress 56(IN_SRC_MAC) 56(inMacAddress)
postDestinationMacAddress 57(OUT_DST_MAC) 57(postDestinationMacAddress)
vlanId 58(SRC_VLAN) 58(srcVlan)
postVlanId 59(DST_VLAN) 59(dstVlan)
ipVersion 60(IP_PROTOCOL_VERSION) 60(ipVersion)
flowDirection 61(DIRECTION) 61(direction) 61(Direction)
ipNextHopIPv6Address 62(IPV6_NEXT_HOP) 62(ipNextHopIPv6Address)
bgpNextHopAddress 63(BPG_IPV6_NEXT_HOP) 63(bgpNextHopIPv6Address)
ipv6ExtensionHeaders 64(IPV6_OPTION_HEADERS) 64(ipv6ExtensionHeaders)
custom_2 65(Vendor Proprietary) Assigned for NetFlow v9 compatibility
custom_3 66(Vendor Proprietary)
custom_4 67(Vendor Proprietary)
custom_5 68(Vendor Proprietary)
custom_6 69(Vendor Proprietary)
mplsTopLabelStackSection 70(MPLS_LABEL_1) 70(mplsTopLabelStackSection)
mplsLabelStackSection2 71(MPLS_LABEL_2) 71(mplsLabelStackSection2)
mplsLabelStackSection3 72(MPLS_LABEL_3) 72(mplsLabelStackSection3)
mplsLabelStackSection4 73(MPLS_LABEL_4) 73(mplsLabelStackSection4)
mplsLabelStackSection5 74(MPLS_LABEL_5) 74(mplsLabelStackSection5)
mplsLabelStackSection6 75(MPLS_LABEL_6) 75(mplsLabelStackSection6)
mplsLabelStackSection7 76(MPLS_LABEL_7) 76(mplsLabelStackSection7)
mplsLabelStackSection8 77(MPLS_LABEL_8) 77(mplsLabelStackSection8)
mplsLabelStackSection9 78(MPLS_LABEL_9) 78(mplsLabelStackSection9)
mplsLabelStackSection10 79(MPLS_LABEL_10) 79(mplsLabelStackSection10)
destinationMacAddress 80(IN_DST_MAC) 80(inMacAddress)
postSourceMacAddress 81(OUT_SRC_MAC) 81(postSourceMacAddress)
interfaceName 82(IF_NAME) 82(ifName)
interfaceDescription 83(IF_DESC) 83(ifDesc)
samplerName 84(SAMPLER_NAME) 84(samplerName)
octetTotalCount 85(IN_ PERMANENT _BYTES) 85(inTotalCount)
packetTotalCount 86(IN_ PERMANENT _PKTS) 86(inTotalCount)
flagsAndSamplerId 87(Vendor Proprietary) 87(flagsAndSamplerId)
78 Network Performance Insight References
Normalized Flow Fields V9 Field name IPFIX field name
fragmentOffset 88(FRAGMENT_OFFSET) 88(fragmentOffset)
forwardingStatus 89(FORWARDING STATUS) 89(forwarding status)
mplsVpnRouteDistinguisher 90(MPLS PAL RD) 90(mplsVpnRouteDistinguisher)
mplsTopLabelPrefixLength 91(MPLS PREFIX LEN) 91(mplsTopLabelPrefixLength)
srcTrafficIndex 92(SRC TRAFFIC INDEX) 92(src traffic index)
dstTrafficIndex 93(DST TRAFFIC INDEX) 93(dst traffic index)
unknown_1 N/A Assigned for NetFlow v9 compatibility
postIpDiffServCodePoint 98(postipDiffServCodePoint) 98(postIpDiffServCodePoint)
multicastReplicationFactor 99(replication factor) 99(replication factor)
className Deprecated 100(className)
classificationEngineId N/A 101(classificationEngineId)
layer2packetSectionOffset 102(layer2packetSectionOffset) 102(layer2packetsectionoffset)
layer2packetSectionSize 103(layer2packetSectionSize) 103(layer2packetsectionsize)
layer2packetSectionData 104(layer2packetSectionData) 104(layer2packetsectiondata)
application version 105(application version) 105(application version)
application version name 106(application version name) 106(application version name)
application vendor 107(application vendor ) 107(application vendor )
sub application name 109(sub application name) 109(sub application name)
sub application description 110(sub application description) 110(sub application description)
template parameter range end 111(template parameter range end) 111(template parameter range end)
112-127 Assigned for NetFlow V9 compatibility Assigned for NetFlow V9 compatibility
bgpNextAdjacentAsNumber 128(bgpNextAdjacentAsNumber) 128(bgpNextAdjacentAsNumber)
bgpPrevAdjacentAsNumber 129(bgpPrevAdjacentAsNumber) 129(bgpPrevAdjacentAsNumber)
exporterIPv4Address 130(exporterIPv4Address) 130(exporterIPv4Address)
exporterIPv6Address 131(exporterIPv6Address) 131(exporterIPv6Address)
droppedOctetDeltaCount 132(droppedOctetDeltaCount) 132(droppedOctetDeltaCount)
droppedPacketDeltaCount 133(droppedPacketDeltaCount) 133(droppedPacketDeltaCount)
droppedOctetTotalCount 134(droppedOctetTotalCount) 134(droppedOctetTotalCount)
droppedPacketTotalCount 135(droppedPacketTotalCount) 135(droppedPacketTotalCount)
flowEndReason 136(flowEndReason) 136(flowEndReason)
commonPropertiesId 137(commonPropertiesId) 137(commonPropertiesId)
observationPointId 138(observationPointId) 138(observationPointId)
icmpTypeCodeIPv6 139(icmpTypeCodeIPv6) 139(icmpTypeCodeIPv6)
mplsTopLabelIPv6Address 140(mplsTopLabelIPv6Address) 140(mplsTopLabelIPv6Address)
lineCardId 141(lineCardId) 141(lineCardId)
portId 142(portId) 142(portId)
meteringProcessId 143(meteringProcessId) 143(meteringProcessId)
exportingProcessId 144(exportingProcessId) 144(exportingProcessId)
templateId 145(templateId) 145(templateId)
wlanChannelId 146(wlanChannelId) 146(wlanChannelId)
wlanSSID 147(wlanSSID) 147(wlanSSID)
Chapter 3. NetFlow versions 79
Normalized Flow Fields V9 Field name IPFIX field name
flowId 148(flowId) 148(flowId)
observationDomainId 149(observationDomainId) 149(observationDomainId)
flowStartSeconds 150(flowStartSeconds) 150(flowStartSeconds)
flowEndSeconds 151(flowEndSeconds) 151(flowEndSeconds)
flowStartMilliseconds 152(flowStartMilliseconds) 152(flowStartMilliseconds)
flowEndMilliseconds 153(flowEndMilliseconds) 153(flowEndMilliseconds)
flowStartMicroseconds 154(flowStartMicroseconds) 154(flowStartMicroseconds)
flowEndMicroseconds 155(flowEndMicroseconds) 155(flowEndMicroseconds)
flowStartNanoseconds 156(flowStartNanoseconds) 156(flowStartNanoseconds)
flowEndNanoseconds 157(flowEndNanoseconds) 157(flowEndNanoseconds)
flowStartDeltaMicroseconds 158(flowStartDeltaMicroseconds) 158(flowStartDeltaMicroseconds)
flowEndDeltaMicroseconds 159(flowEndDeltaMicroseconds) 159(flowEndDeltaMicroseconds)
systemInitTimeMilliseconds 160(systemInitTimeMilliseconds) 160(systemInitTimeMilliseconds)
flowDurationMilliseconds 161(flowDurationMilliseconds) 161(flowDurationMilliseconds)
flowDurationMicroseconds 162(flowDurationMicroseconds) 162(flowDurationMicroseconds)
observedFlowTotalCount 163(observedFlowTotalCount) 163(observedFlowTotalCount)
ignoredPacketTotalCount 164(ignoredPacketTotalCount) 164(ignoredPacketTotalCount)
ignoredOctetTotalCount 165(ignoredOctetTotalCount) 165(ignoredOctetTotalCount)
notSentFlowTotalCount 166(notSentFlowTotalCount) 166(notSentFlowTotalCount)
notSentPacketTotalCount 167(notSentPacketTotalCount) 167(notSentPacketTotalCount)
notSentOctetTotalCount 168(notSentOctetTotalCount) 168(notSentOctetTotalCount)
destinationIPv6Prefix 169(destinationIPv6Prefix) 169(destinationIPv6Prefix)
sourceIPv6Prefix 170(sourceIPv6Prefix) 170(sourceIPv6Prefix)
postOctetTotalCount 171(postOctetTotalCount) 171(postOctetTotalCount)
postPacketTotalCount 172(postPacketTotalCount) 172(postPacketTotalCount)
flowKeyIndicator 173(flowKeyIndicator) 173(flowKeyIndicator)
postMCastPacketTotalCount 174(postMCastPacketTotalCount) 174(postMCastPacketTotalCount)
postMCastOctetTotalCount 175(postMCastOctetTotalCount) 175(postMCastOctetTotalCount)
icmpTypeIPv4 176(icmpTypeIPv4) 176(icmpTypeIPv4)
icmpCodeIPv4 177(icmpCodeIPv4) 177(icmpCodeIPv4)
icmpTypeIPv6 178(icmpTypeIPv6) 178(icmpTypeIPv6)
icmpCodeIPv6 178(icmpTypeIPv6) 179(icmpCodeIPv6)
udpSourcePort 180(udpSourcePort) 180(udpSourcePort)
udpDestinationPort 181(udpDestinationPort) 181(udpDestinationPort)
tcpSourcePort 182(tcpSourcePort) 182(tcpSourcePort)
tcpDestinationPort 183(tcpDestinationPort) 183(tcpDestinationPort)
tcpSequenceNumber 184(tcpSequenceNumber) 184(tcpSequenceNumber)
tcpAcknowledgementNumber 185(tcpAcknowledgementNumber) 185(tcpAcknowledgementNumber)
tcpWindowSize 186(tcpWindowSize) 186(tcpWindowSize)
tcpUrgentPointer 187(tcpUrgentPointer) 187(tcpUrgentPointer)
tcpHeaderLength 188(tcpHeaderLength) 188(tcpHeaderLength)
80 Network Performance Insight References
Normalized Flow Fields V9 Field name IPFIX field name
ipHeaderLength 189(ipHeaderLength) 189(ipHeaderLength)
totalLengthIPv4 190(totalLengthIPv4) 190(totalLengthIPv4)
payloadLengthIPv6 191(payloadLengthIPv6) 191(payloadLengthIPv6)
ipTTL 192(ipTTL) 192(ipTTL)
nextHeaderIPv6 193(nextHeaderIPv6) 193(nextHeaderIPv6)
mplsPayloadLength 194(mplsPayloadLength) 194(mplsPayloadLength)
ipDiffServCodePoint 195(ipDiffServCodePoint) 195(ipDiffServCodePoint)
ipPrecedence 196(ipPrecedence) 196(ipPrecedence)
fragmentFlags 197(fragmentFlags) 197(fragmentFlags)
octetDeltaSumOfSquares 198(octetDeltaSumOfSquares) 198(octetDeltaSumOfSquares)
octetTotalSumOfSquares 199(octetTotalSumOfSquares) 199(octetTotalSumOfSquares)
mplsTopLabelTTL 200(mplsTopLabelTTL) 200(mplsTopLabelTTL)
mplsLabelStackLength 201(mplsLabelStackLength) 201(mplsLabelStackLength)
mplsLabelStackDepth 202(mplsLabelStackDepth) 202(mplsLabelStackDepth)
mplsTopLabelExp 203(mplsTopLabelExp) 203(mplsTopLabelExp)
ipPayloadLength 204(ipPayloadLength) 204(ipPayloadLength)
udpMessageLength 205(udpMessageLength) 205(udpMessageLength)
isMulticast 206(isMulticast) 206(isMulticast)
ipv4IHL 207(ipv4IHL) 207(ipv4IHL)
ipv4Options 208(ipv4Options) 208(ipv4Options)
tcpOptions 209(tcpOptions) 209(tcpOptions)
paddingOctets 210(paddingOctets) 210(paddingOctets)
collectorIPv4Address 211(collectorIPv4Address) 211(collectorIPv4Address)
collectorIPv6Address 212(collectorIPv6Address) 212(collectorIPv6Address)
exportInterface 213(exportInterface) 213(exportInterface)
exportProtocolVersion 214(exportProtocolVersion) 214(exportProtocolVersion)
exportTransportProtocol 215(exportTransportProtocol) 215(exportTransportProtocol)
collectorTransportPort 216(collectorTransportPort) 216(collectorTransportPort)
exporterTransportPort 217(exporterTransportPort) 217(exporterTransportPort)
tcpSynTotalCount 218(tcpSynTotalCount) 218(tcpSynTotalCount)
tcpFinTotalCount 219(tcpFinTotalCount) 219(tcpFinTotalCount)
tcpRstTotalCount 220(tcpRstTotalCount) 220(tcpRstTotalCount)
tcpPshTotalCount 221(tcpPshTotalCount) 221(tcpPshTotalCount)
tcpAckTotalCount 222(tcpAckTotalCount) 222(tcpAckTotalCount)
tcpUrgTotalCount 223(tcpUrgTotalCount) 223(tcpUrgTotalCount)
ipTotalLength 224(ipTotalLength) 224(ipTotalLength)
postNATSourceIPv4Address 225(postNATSourceIPv4Address) 225(postNATSourceIPv4Address)
postNATDestinationIPv4Address 226(postNATDestinationIPv4Address) 226(postNATDestinationIPv4Address)
postNAPTSourceTransportPort 227(postNAPTSourceTransportPort) 227(postNAPTSourceTransportPort)
postNAPTDestinationTransportPort 228(postNAPTDestinationTransportPort) 228(postNAPTDestinationTransportPort)
natOriginatingAddressRealm 229(natOriginatingAddressRealm) 229(natOriginatingAddressRealm)
Chapter 3. NetFlow versions 81
Normalized Flow Fields V9 Field name IPFIX field name
natEvent 230(natEvent) 230(natEvent)
initiatorOctets 231(initiatorOctets) 231(initiatorOctets)
responderOctets 232(responderOctets) 232(responderOctets)
firewallEvent 233(firewallEvent) 233(firewallEvent)
ingressVRFID 234(ingressVRFID) 234(ingressVRFID)
egressVRFID 235(egressVRFID) 235(egressVRFID)
VRFname 236(VRFname) 236(VRFname)
postMplsTopLabelExp 237(postMplsTopLabelExp) 237(postMplsTopLabelExp)
tcpWindowScale 238(tcpWindowScale) 238(tcpWindowScale)
biflowDirection 239(biflowDirection) 239(biflowDirection)
ethernetHeaderLength 240(ethernetHeaderLength) 240(ethernetHeaderLength)
ethernetPayloadLength 241(ethernetPayloadLength) 241(ethernetPayloadLength)
ethernetTotalLength 242(ethernetTotalLength) 242(ethernetTotalLength)
dot1qVlanId 243(dot1qVlanId) 243(dot1qVlanId)
dot1qPriority 244(dot1qPriority) 244(dot1qPriority)
dot1qCustomerVlanId 245(dot1qCustomerVlanId) 245(dot1qCustomerVlanId)
dot1qCustomerPriority 246(dot1qCustomerPriority) 246(dot1qCustomerPriority)
metroEvcId 247(metroEvcId) 247(metroEvcId)
metroEvcType 248(metroEvcType) 248(metroEvcType)
pseudoWireId 249(pseudoWireId) 249(pseudoWireId)
pseudoWireType 250(pseudoWireType) 250(pseudoWireType)
pseudoWireControlWord 251(pseudoWireControlWord) 251(pseudoWireControlWord)
ingressPhysicalInterface 252(ingressPhysicalInterface) 252(ingressPhysicalInterface)
egressPhysicalInterface 253(egressPhysicalInterface) 253(egressPhysicalInterface)
postDot1qVlanId 254(postDot1qVlanId) 254(postDot1qVlanId)
postDot1qCustomerVlanId 255(postDot1qCustomerVlanId) 255(postDot1qCustomerVlanId)
ethernetType 256(ethernetType) 256(ethernetType)
postIpPrecedence 257(postIpPrecedence) 257(postIpPrecedence)
collectionTimeMilliseconds 258(collectionTimeMilliseconds) 258(collectionTimeMilliseconds)
exportSctpStreamId 259(exportSctpStreamId) 259(exportSctpStreamId)
maxExportSeconds 260(maxExportSeconds) 260(maxExportSeconds)
maxFlowEndSeconds 261(maxFlowEndSeconds) 261(maxFlowEndSeconds)
messageMD5Checksum 262(messageMD5Checksum) 262(messageMD5Checksum)
messageScope 263(messageScope) 263(messageScope)
minExportSeconds 264(minExportSeconds) 264(minExportSeconds)
minFlowStartSeconds 265(minFlowStartSeconds) 265(minFlowStartSeconds)
opaqueOctets 266(opaqueOctets) 266(opaqueOctets)
sessionScope 267(sessionScope) 267(sessionScope)
maxFlowEndMicroseconds 268(maxFlowEndMicroseconds) 268(maxFlowEndMicroseconds)
maxFlowEndMilliseconds 269(maxFlowEndMilliseconds) 269(maxFlowEndMilliseconds)
maxFlowEndNanoseconds 270(maxFlowEndNanoseconds) 270(maxFlowEndNanoseconds)
82 Network Performance Insight References
Normalized Flow Fields V9 Field name IPFIX field name
minFlowStartMicroseconds 271(minFlowStartMicroseconds) 271(minFlowStartMicroseconds)
minFlowStartMilliseconds 272(minFlowStartMilliseconds) 272(minFlowStartMilliseconds)
minFlowStartNanoseconds 273(minFlowStartNanoseconds) 273(minFlowStartNanoseconds)
collectorCertificate 274(collectorCertificate) 274(collectorCertificate)
exporterCertificate 275(exporterCertificate) 275(exporterCertificate)
dataRecordsReliability 276(dataRecordsReliability) 276(dataRecordsReliability)
observationPointType 277(observationPointType) 277(observationPointType)
connectionCountNew 278(connectionCountNew) 278(connectionCountNew)
connectionSumDurationSeconds 279(connectionSumDurationSeconds) 279(connectionSumDurationSeconds)
connectionTransactionId 280(connectionTransactionId) 280(connectionTransactionId)
postNATSourceIPv6Address 281(postNATSourceIPv6Address) 281(postNATSourceIPv6Address)
postNATDestinationIPv6Address 282(postNATDestinationIPv6Address) 282(postNATDestinationIPv6Address)
natPoolId 283(natPoolId) 283(natPoolId)
natPoolName 284(natPoolName) 284(natPoolName)
anonymizationFlags 285(anonymizationFlags) 285(anonymizationFlags)
anonymizationTechnique 286(anonymizationTechnique) 286(anonymizationTechnique)
informationElementIndex 287(informationElementIndex) 287(informationElementIndex)
p2pTechnology 288(p2pTechnology) 288(p2pTechnology)
tunnelTechnology 289(tunnelTechnology) 289(tunnelTechnology)
encryptedTechnology 290(encryptedTechnology) 290(encryptedTechnology)
basicList 291(basicList) 291(basicList)
subTemplateList 292(subTemplateList) 292(subTemplateList)
subTemplateMultiList 293(subTemplateMultiList) 293(subTemplateMultiList)
bgpValidityState 294(bgpValidityState) 294(bgpValidityState)
IPSecSPI 295(IPSecSPI) 295(IPSecSPI)
greKey 296(greKey) 296(greKey)
natType 297(natType) 297(natType)
initiatorPackets 298(initiatorPackets) 298(initiatorPackets)
responderPackets 299(responderPackets) 299(responderPackets)
observationDomainName 300(observationDomainName) 300(observationDomainName)
selectionSequenceId 301(selectionSequenceId) 301(selectionSequenceId)
selectorId 302(selectorId) 302(selectorId)
informationElementId 303(informationElementId) 303(informationElementId)
selectorAlgorithm 304(selectorAlgorithm) 304(selectorAlgorithm)
samplingPacketInterval 305(samplingPacketInterval) 305(samplingPacketInterval)
samplingPacketSpace 306(samplingPacketSpace) 306(samplingPacketSpace)
samplingTimeInterval 307(samplingTimeInterval) 307(samplingTimeInterval)
samplingTimeSpace 308(samplingTimeSpace) 308(samplingTimeSpace)
samplingSize 309(samplingSize) 309(samplingSize)
samplingPopulation 310(samplingPopulation) 310(samplingPopulation)
samplingProbability 311(samplingProbability) 311(samplingProbability)
Chapter 3. NetFlow versions 83
Normalized Flow Fields V9 Field name IPFIX field name
dataLinkFrameSize 312(dataLinkFrameSize) 312(dataLinkFrameSize)
ipHeaderPacketSection 313(ipHeaderPacketSection) 313(ipHeaderPacketSection)
ipPayloadPacketSection 314(ipPayloadPacketSection) 314(ipPayloadPacketSection)
dataLinkFrameSection 315(dataLinkFrameSection) 315(dataLinkFrameSection)
mplsLabelStackSection 316(mplsLabelStackSection) 316(mplsLabelStackSection)
mplsPayloadPacketSection 317(mplsPayloadPacketSection) 317(mplsPayloadPacketSection)
selectorIdTotalPktsObserved 318(selectorIdTotalPktsObserved) 318(selectorIdTotalPktsObserved)
selectorIdTotalPktsSelected 319(selectorIdTotalPktsSelected) 319(selectorIdTotalPktsSelected)
absoluteError 320(absoluteError) 320(absoluteError)
relativeError 321(relativeError) 321(relativeError)
observationTimeSeconds 322(observationTimeSeconds) 322(observationTimeSeconds)
observationTimeMilliseconds 323(observationTimeMilliseconds) 323(observationTimeMilliseconds)
observationTimeMicroseconds 324(observationTimeMicroseconds) 324(observationTimeMicroseconds)
observationTimeNanoseconds 325(observationTimeNanoseconds) 325(observationTimeNanoseconds)
digestHashValue 326(digestHashValue) 326(digestHashValue)
hashIPPayloadOffset 327(hashIPPayloadOffset) 327(hashIPPayloadOffset)
hashIPPayloadSize 328(hashIPPayloadSize) 328(hashIPPayloadSize)
hashOutputRangeMin 329(hashOutputRangeMin) 329(hashOutputRangeMin)
hashOutputRangeMax 330(hashOutputRangeMax) 330(hashOutputRangeMax)
hashSelectedRangeMin 331(hashSelectedRangeMin) 331(hashSelectedRangeMin)
hashSelectedRangeMax 332(hashSelectedRangeMax) 332(hashSelectedRangeMax)
hashDigestOutput 333(hashDigestOutput) 333(hashDigestOutput)
hashInitialiserValue 334(hashInitialiserValue) 334(hashInitialiserValue)
selectorName 335(selectorName) 335(selectorName)
upperCILimit 336(upperCILimit) 336(upperCILimit)
lowerCILimit 337(lowerCILimit) 337(lowerCILimit)
confidenceLevel 338(confidenceLevel) 338(confidenceLevel)
informationElementDataType 339(informationElementDataType) 339(informationElementDataType)
informationElementDescription 340(informationElementDescription) 340(informationElementDescription)
informationElementName 341(informationElementName) 341(informationElementName)
informationElementRangeBegin 342(informationElementRangeBegin) 342(informationElementRangeBegin)
informationElementRangeEnd 343(informationElementRangeEnd) 343(informationElementRangeEnd)
informationElementSemantics 344(informationElementSemantics) 344(informationElementSemantics)
informationElementUnits 345(informationElementUnits) 345(informationElementUnits)
privateEnterpriseNumber 346(privateEnterpriseNumber) 346(privateEnterpriseNumber)
virtualStationInterfaceId 347(virtualStationInterfaceId) 347(virtualStationInterfaceId)
virtualStationInterfaceName 348(virtualStationInterfaceName) 348(virtualStationInterfaceName)
virtualStationUUID 349(virtualStationUUID) 349(virtualStationUUID)
virtualStationName 350(virtualStationName) 350(virtualStationName)
layer2SegmentId 351(layer2SegmentId) 351(layer2SegmentId)
layer2OctetDeltaCount 352(layer2OctetDeltaCount) 352(layer2OctetDeltaCount)
84 Network Performance Insight References
Normalized Flow Fields V9 Field name IPFIX field name
layer2OctetTotalCount 353(layer2OctetTotalCount) 353(layer2OctetTotalCount)
ingressUnicastPacketTotalCount 354(ingressUnicastPacketTotalCount) 354(ingressUnicastPacketTotalCount)
ingressMulticastPacketTotalCount 355(ingressMulticastPacketTotalCount) 355(ingressMulticastPacketTotalCount)
ingressBroadcastPacketTotalCount 356(ingressBroadcastPacketTotalCount) 356(ingressBroadcastPacketTotalCount)
egressUnicastPacketTotalCount 357(egressUnicastPacketTotalCount) 357(egressUnicastPacketTotalCount)
egressBroadcastPacketTotalCount 358(egressBroadcastPacketTotalCount) 358(egressBroadcastPacketTotalCount)
monitoringIntervalStartMilliSeconds 359(monitoringIntervalStartMilliSeconds)359(monitoringIntervalStartMilliSeconds)
monitoringIntervalEndMilliSeconds 360(monitoringIntervalEndMilliSeconds) 360(monitoringIntervalEndMilliSeconds)
portRangeStart 361(portRangeStart) 361(portRangeStart)
portRangeEnd 362(portRangeEnd) 362(portRangeEnd)
portRangeStepSize 363(portRangeStepSize) 363(portRangeStepSize)
portRangeNumPorts 364(portRangeNumPorts) 364(portRangeNumPorts)
staMacAddress 365(staMacAddress) 365(staMacAddress)
staIPv4Address 366(staIPv4Address) 366(staIPv4Address)
wtpMacAddress 367(wtpMacAddress) 367(wtpMacAddress)
ingressInterfaceType 368(ingressInterfaceType) 368(ingressInterfaceType)
egressInterfaceType 369(egressInterfaceType) 369(egressInterfaceType)
rtpSequenceNumber 370(rtpSequenceNumber) 370(rtpSequenceNumber)
userName 371(userName) 371(userName)
applicationCategoryName 372(applicationCategoryName) 372(applicationCategoryName)
applicationCategoryName 373(applicationCategoryName) 373(applicationCategoryName)
applicationGroupName 374(applicationGroupName) 374(applicationGroupName)
originalFlowsPresent 375(originalFlowsPresent) 375(originalFlowsPresent)
originalFlowsInitiated 376(originalFlowsInitiated) 376(originalFlowsInitiated)
originalFlowsCompleted 377(originalFlowsCompleted) 377(originalFlowsCompleted)
distinctCountOfSourceIPAddress
378(distinctCountOfSourceIPAddress)
378(distinctCountOfSourceIPAddress)
distinctCountOfDestinationIPAddress
379(distinctCountOfDestinationIPAddress)
379(distinctCountOfDestinationIPAddress)
distinctCountOfSourceIPv4Address
380(distinctCountOfSourceIPv4Address)
380(distinctCountOfSourceIPv4Address)
distinctCountOfDestinationIPv4Address
381(distinctCountOfDestinationIPv4Address)
381(distinctCountOfDestinationIPv4Address)
distinctCountOfSourceIPv6Address
382(distinctCountOfSourceIPv6Address)
382(distinctCountOfSourceIPv6Address)
distinctCountOfDestinationIPv6Address
383(distinctCountOfDestinationIPv6Address)
383(distinctCountOfDestinationIPv6Address)
valueDistributionMethod 384(valueDistributionMethod) 384(valueDistributionMethod)
rfc3550JitterMilliseconds 385(rfc3550JitterMilliseconds) 385(rfc3550JitterMilliseconds)
rfc3550JitterMicroseconds 386(rfc3550JitterMicroseconds) 386(rfc3550JitterMicroseconds)
rfc3550JitterNanoseconds 387(rfc3550JitterNanoseconds) 387(rfc3550JitterNanoseconds)
dot1qDEI 388(dot1qDEI) 388(dot1qDEI)
Chapter 3. NetFlow versions 85
Normalized Flow Fields V9 Field name IPFIX field name
dot1qCustomerDEI 389(dot1qCustomerDEI) 389(dot1qCustomerDEI)
flowSelectorAlgorithm 390(flowSelectorAlgorithm) 390(flowSelectorAlgorithm)
flowSelectedOctetDeltaCount 391(flowSelectedOctetDeltaCount) 391(flowSelectedOctetDeltaCount)
flowSelectedPacketDeltaCount 392(flowSelectedPacketDeltaCount) 392(flowSelectedPacketDeltaCount)
flowSelectedFlowDeltaCount 393(flowSelectedFlowDeltaCount) 393(flowSelectedFlowDeltaCount)
selectorIDTotalFlowsObserved 394(selectorIDTotalFlowsObserved) 394(selectorIDTotalFlowsObserved)
selectorIDTotalFlowsSelected 395(selectorIDTotalFlowsSelected) 395(selectorIDTotalFlowsSelected)
samplingFlowInterval 396(samplingFlowInterval) 396(samplingFlowInterval)
samplingFlowSpacing 397(samplingFlowSpacing) 397(samplingFlowSpacing)
flowSamplingTimeInterval 398(flowSamplingTimeInterval) 398(flowSamplingTimeInterval)
flowSamplingTimeSpacing 399(flowSamplingTimeSpacing) 399(flowSamplingTimeSpacing)
hashFlowDomain 400(hashFlowDomain) 400(hashFlowDomain)
transportOctetDeltaCount 401(transportOctetDeltaCount) 401(transportOctetDeltaCount)
transportPacketDeltaCount 402(transportPacketDeltaCount) 402(transportPacketDeltaCount)
originalExporterIPv4Address 403(originalExporterIPv4Address) 403(originalExporterIPv4Address)
originalExporterIPv6Address 404(originalExporterIPv6Address) 404(originalExporterIPv6Address)
originalObservationDomainId 405(originalObservationDomainId) 405(originalObservationDomainId)
intermediateProcessId 406(intermediateProcessId) 406(intermediateProcessId)
ignoredDataRecordTotalCount 407(ignoredDataRecordTotalCount) 407(ignoredDataRecordTotalCount)
dataLinkFrameType 408(dataLinkFrameType) 408(dataLinkFrameType)
sectionOffset 409(sectionOffset) 409(sectionOffset)
sectionExportedOctets 410(sectionExportedOctets) 410(sectionExportedOctets)
dot1qServiceInstanceTag 411(dot1qServiceInstanceTag) 411(dot1qServiceInstanceTag)
dot1qServiceInstanceId 412(dot1qServiceInstanceId) 412(dot1qServiceInstanceId)
dot1qServiceInstancePriority 413(dot1qServiceInstancePriority) 413(dot1qServiceInstancePriority)
dot1qCustomerSourceMacAddress 414(dot1qCustomerSourceMacAddress) 414(dot1qCustomerSourceMacAddress)
dot1qCustomerDestinationMacAddress
415(dot1qCustomerDestinationMacAddress)
415(dot1qCustomerDestinationMacAddress)
layer2OctetDeltaCount 416(layer2OctetDeltaCount) 416(layer2OctetDeltaCount)
postL2OctetDeltaCount 417(postL2OctetDeltaCount) 417(postL2OctetDeltaCount)
postMCastL2OctetDeltaCount 418(postMCastL2OctetDeltaCount) 418(postMCastL2OctetDeltaCount)
layer2OctetTotalCount 419(layer2OctetTotalCount) 419(layer2OctetTotalCount)
postL2OctetTotalCount 420(postL2OctetTotalCount) 420(postL2OctetTotalCount)
postMCastL2OctetTotalCount 421(postMCastL2OctetTotalCount) 421(postMCastL2OctetTotalCount)
minimumL2TotalLength 422(minimumL2TotalLength) 422(minimumL2TotalLength)
maximumL2TotalLength 423(maximumL2TotalLength) 423(maximumL2TotalLength)
droppedL2OctetDeltaCount 424(droppedL2OctetDeltaCount) 424(droppedL2OctetDeltaCount)
droppedL2OctetTotalCount 425(droppedL2OctetTotalCount) 425(droppedL2OctetTotalCount)
ignoredL2OctetTotalCount 426(ignoredL2OctetTotalCount) 426(ignoredL2OctetTotalCount)
notSentL2OctetTotalCount 427(notSentL2OctetTotalCount) 427(notSentL2OctetTotalCount)
l2OctetDeltaSumOfSquares 428(l2OctetDeltaSumOfSquares) 428(l2OctetDeltaSumOfSquares)
86 Network Performance Insight References
Normalized Flow Fields V9 Field name IPFIX field name
l2OctetTotalSumOfSquares 429(l2OctetTotalSumOfSquares) 429(l2OctetTotalSumOfSquares)
layer2FrameDeltaCount 430(E451layer2FrameDeltaCount) 430(E451layer2FrameDeltaCount)
layer2FrameTotalCount 431(layer2FrameTotalCount) 431(layer2FrameTotalCount)
pseudoWireDestinationIPv4Address 432(pseudoWireDestinationIPv4Address)432(pseudoWireDestinationIPv4Address)
ignoredLayer2FrameTotalCount 433(ignoredLayer2FrameTotalCount) 433(ignoredLayer2FrameTotalCount)
mibObjectValueInteger 434(mibObjectValueInteger) 434(mibObjectValueInteger)
mibObjectValueOctetString 435(mibObjectValueOctetString) 435(mibObjectValueOctetString)
mibObjectValueOID 436(mibObjectValueOID) 436(mibObjectValueOID)
mibObjectValueBits 437(mibObjectValueBits) 437(mibObjectValueBits)
mibObjectValueIPAddress 438(mibObjectValueIPAddress) 438(mibObjectValueIPAddress)
mibObjectValueCounter 439(mibObjectValueCounter) 439(mibObjectValueCounter)
mibObjectValueGauge 440(mibObjectValueGauge) 440(mibObjectValueGauge)
mibObjectValueTimeTicks 441(mibObjectValueTimeTicks) 441(mibObjectValueTimeTicks)
mibObjectValueUnsigned 442(mibObjectValueUnsigned) 442(mibObjectValueUnsigned)
mibObjectValueTable 443(mibObjectValueTable) 443(mibObjectValueTable)
mibObjectValueRow 444(mibObjectValueRow) 444(mibObjectValueRow)
mibObjectIdentifier 445(mibObjectIdentifier) 445(mibObjectIdentifier)
mibSubIdentifier 446(mibSubIdentifier) 446(mibSubIdentifier)
mibIndexIndicator 447(mibIndexIndicator) 447(mibIndexIndicator)
mibCaptureTimeSemantics 448(mibCaptureTimeSemantics) 448(mibCaptureTimeSemantics)
mibContextEngineID 449(mibContextEngineID) 449(mibContextEngineID)
mibContextName 450(mibContextName) 450(mibContextName)
mibObjectName 451(mibObjectName) 451(mibObjectName)
mibObjectDescription 452(mibObjectDescription) 452(mibObjectDescription)
mibObjectSyntax 453(mibObjectSyntax) 453(mibObjectSyntax)
mibModuleName 454(mibModuleName) 454(mibModuleName)
mobileIMSI 455(mobileIMSI) 455(mobileIMSI)
mobileMSISDN 456(mobileMSISDN) 456(mobileMSISDN)
httpStatusCode 457(httpStatusCode) 457(httpStatusCode)
sourceTransportPortsLimit 458(sourceTransportPortsLimit) 458(sourceTransportPortsLimit)
httpRequestMethod 459(httpRequestMethod) 459(httpRequestMethod)
httpRequestHost 460(httpRequestHost) 460(httpRequestHost)
httpRequestTarget 461(httpRequestTarget) 461(httpRequestTarget)
httpMessageVersion 462(natInstanceID) 462(natInstanceID)
natInstanceID 463(natInstanceID) 463(natInstanceID)
internalAddressRealm 464(internalAddressRealm) 464(internalAddressRealm)
externalAddressRealm 465(externalAddressRealm) 465(externalAddressRealm)
natQuotaExceededEvent 466(natQuotaExceededEvent) 466(natQuotaExceededEvent)
natThresholdEvent 467(natThresholdEvent) 467(natThresholdEvent)
httpUserAgent 468(httpUserAgent) 468(httpUserAgent)
httpContentType 769(httpContentType) 769(httpContentType)
Chapter 3. NetFlow versions 87
Normalized Flow Fields V9 Field name IPFIX field name
httpReasonPhrase 470(httpReasonPhrase) 470(httpReasonPhrase)
Related information:
IP Flow Information Export (IPFIX) Entities
88 Network Performance Insight References
Chapter 4. Dashboard reference
Use this reference to understand the Flow or entity metrics that are displayed oneach dashboard, and other properties of the dashboard. The aggregations that areused on the NetFlow dashboards are also specified as applicable.
The following types of metrics are stored in Network Performance Insightdatabase:v Flow metrics
The raw metrics from Flow records are aggregated and stored FLOW_METRICschema tables.
v Entity metricsThe raw metrics that are discovered and polled from Tivoli Network Managerare aggregated and stored in ENTITY_METRIC schema tables.
These individual metrics and a combination of the metrics are displayed in variousdashboards and widgets. The data is queried and retrieved from the database withthe help of REST APIs.
REST (REpresentational State Transfer) APIs rely on a stateless, client/server,cacheable communications protocol. REST applications use HTTP requests to postdata (create and update), read data (such as running queries), and delete data.REST is a lightweight alternative to mechanisms like RPC (Remote ProcedureCalls) and Web Services (such as SOAP and WSDL). Much like Web Services, aREST service is:v Platform-independentv Language-independentv Standards-based (runs on top of HTTP)v Able to be used in the presence of firewalls.
Properties of the Network Performance Overview dashboardThis information provides the properties of the Network Performance Overviewand its associated widgets.
Data flow to Network Performance Overview dashboard and itswidgets
Widget name Metrics Type of data
Top 10 Outbound PacketDiscard Deviation (%)
ifOutDiscards Entity metricNote: Configure this metricfrom Tivoli NetworkManager network polling.
Total Packet Drops PerQueue (Packets)
policyQosQueueDrop Flow metric
Top 10 Inbound PacketDiscard Deviation (%)
ifInDiscards Entity metricNote: Configure this metricfrom Tivoli NetworkManager network polling.
© Copyright IBM Corp. 2015, 2018 89
Widget name Metrics Type of data
Top 10 Applications by TotalDelay (ms)
maxTotalRespTime Flow metric (ApplicationResponse Time)
Top 10 Round-Trip TimeDeviation (%)
echoRTT Entity metric (IPSLA)
Top 10 Probe Loss Deviation(%)
echoProbeLoss Entity metric (IPSLA)
Top 10 Outbound UtilizationDeviation (%)
snmpOutBandwidth Entity metricNote: Configure this metricfrom Tivoli NetworkManager network polling.
Top 10 Applications by TotalVolume (Octets)
APP_NAME Flow metric
Top 10 Inbound UtilizationDeviation (%)
snmpInBandwidth Entity metricNote: Configure this metricfrom Tivoli NetworkManager network polling.
Top 10 Applications byAverage Utilization (%)
APP_NAME Flow metric
Top 10 CPULoad Deviation (%)
v CiscoDevice System CPUUtilization CPM
v cpuBusy
v Huawei CPU Utilization
v JuniperChassis CPUUtilization avg last5min
v JuniperERX CPUUtilization
Entity metrics
Top 10Memory Load Deviation (%)
v CiscoDevice Memory PoolUtilization
v Huawei MemoryUtilization
v JuniperERX MemoryUtilization
Entity metrics
Related information:
Creating simple poll policies
Properties of the NetFlow dashboardsThis information provides the properties of all the NetFlow dashboards.
Data flow to the NetFlow dashboards and widgets
NetFlow dashboards Flow metrics are stored in Network Performance Insightdatabase. The raw metrics from Flow records are aggregated and storedFLOW_METRIC schema tables.
The following table shows the data properties of the Top Talker views in theNetFlow dashboards.
90 Network Performance Insight References
Table 3. NetFlow Dashboards
Aggregation name Grouping keys
Top Applications IF_ID + APP_NAME
Top Applications with ToS IF_ID + APP_NAME+SRC_TOS
Top Conversation Autonomous Systems IF_ID+BGP_SRC_AS_NUM+BGP_DST_AS_NUM
Top Destination Autonomous Systems IF_ID+BGP_DST_AS_NUM
Top Source Autonomous Systems IF_ID+BGP_SRC_AS_NUM
Top Conversations IF_ID+SRC_IP+DST_IP
Top Conversations with Applications IF_ID+SRC_IP+DST_IP+APP_NAME
Top Conversations with ToS IF_ID+SRC_IP+DST_IP+SRC_TOS
Top Destinations IF_ID+DST_IP
Top Destinations with Applications IF_ID+DST_IP+APP_NAME
Top Conversation IP Groups withApplications
IF_ID +SRC_IP_GROUP+DST_IP_GROUP+APP_NAME
Top Conversation IP Groups with Protocols IF_ID +SRC_IP_GROUP+DST_IP_GROUP+PROTOCOL_ID
Top Conversation IP Groups with ToS IF_ID +SRC_IP_GROUP+DST_IP_GROUP+SRC_TOS
Top Destination IP Groups with Applications IF_ID+DST_IP_GROUP+APP_NAME
Top Destination IP Groups with Protocols IF_ID+DST_IP_GROUP+PROTOCOL_ID
Top Destination IP Groups with ToS IF_ID+DST_IP_GROUP+SRC_TOS
Top Source IP Groups with Applications IF_ID+SRC_IP_GROUP+APP_NAME
Top Source IP Groups with Protocols IF_ID+SRC_IP_GROUP+PROTOCOL_ID
Top Source IP Groups with ToS IF_ID+SRC_IP_GROUP+SRC_TOS
Top Protocols IF_ID+PROTOCOL_ID
Top Protocols with Applications IF_ID+PROTOCOL_ID+APP_NAME
Top Protocols with Conversations IF_ID+PROTOCOL_ID+SRC_IP+DST_IP
Top Protocols with Destinations IF_ID+PROTOCOL_ID+DST_IP
Top Protocols with Sources IF_ID+PROTOCOL_ID+SRC_IP
Top Sources IF_ID+SRC_IP
Top Sources with Applications IF_ID+SRC_IP+APP_NAME
Top ToS IF_ID+SRC_TOS
QoS Queue Drops IF_ID+POLICY_QOS_CLASSIFICATION_HIERARCHY+POLICY_QOS_QUEUE_ID
Properties of the On Demand Filtering dashboardsThis information provides the properties of all the On Demand Filteringdashboards.
Data flow to On Demand Filtering dashboards
The following table shows the metrics that are displayed on the On DemandFiltering dashboards.
Chapter 4. Dashboard reference 91
Table 4. IPSLA: On Demand Filtering
SLA Test Displayed KPI Associated metrics
v Echo
v TcpConnect
v UdpEcho
Probe Count (count) echoProbeCount
Probe Loss (%) echoProbeLoss
Probe Succeeded (%) echoProbeSucceeded
RTT (ms) echoRtt
Jitter
Inbound Jitter (ms) jitterAvgInbound
Outbound Jitter (ms) jitterAvgOutbound
Inbound One Way Latency(ms)
jitterAvgInboundOneWay
Outbound One Way Latency(ms)
jitterAvgOutboundOneWay
Inbound Packet Loss (%) jitterPacketLossInbound
Outbound Packet Loss (%) jitterPacketLossOutbound
VoIP
Inbound Jitter (ms) jitterAvgInbound
Outbound Jitter (ms) jitterAvgOutbound
Inbound One Way Latency(ms)
jitterAvgInboundOneWay
Outbound One Way Latency(ms)
jitterAvgOutboundOneWay
Inbound Packet Loss (%) jitterPacketLossInbound
Outbound Packet Loss (%) jitterPacketLossOutbound
MOS (count) voipMos
RTP
Inbound Jitter (ms) rtpInterArrivalJitterInbound
Outbound Jitter (ms) rtpInterArrivalJitterOutbound
Inbound One Way Latency(ms)
rtpAvgInbound
Outbound One Way Latency(ms)
rtpAvgOutbound
Inbound Packet Loss (%) rtpPacketLossInbound
Outbound Packet Loss (%) rtpPacketLossOutbound
RTT (ms) rtpRtt
HTTP
RTT (ms) httpRtt
DNS RTT (ms) httpDnsRtt
TCP Connect RTT (ms) httpTcpConnectRtt
Table 5. Device Health: On Demand Filtering
Displayed KPI Associated metrics Type of data
Inbound Utilization (%) snmpInBandwidth Entity metric
Note: Configure thesemetrics from Tivoli NetworkManager network polling.
Outbound Utilization (%) snmpOutBandwidth
Inbound Errors (pkts) ifInErrors
Outbound Errors (pkts) ifOutErrors
Performance Metric OOTB Device Support metrics
92 Network Performance Insight References
Table 5. Device Health: On Demand Filtering (continued)
Displayed KPI Associated metrics Type of data
Inbound Volumes (octets) RFCMIBII Inbound Volume HCoctets
Entity metric
Note: Configure thesemetrics from Tivoli NetworkManager network polling.
Outbound Volumes (octets) RFCMIBII Outbound VolumeHC octets
Inbound Throughput (bps) RFCMIBII InboundThroughput HC bps
Outbound Throughput (bps) RFCMIBII OutboundThroughput HC bps
CPU (%) v cpuBusy
v CiscoDevice System CPUUtilization CPM
v Huawei CPU Utilization
v JuniperChassis CPUService InterruptUtilization
v JuniperChassis CPUUtilization avg last5min
v JuniperERX CPU
Memory (%) v CiscoDevice Memory PoolUtilization
v CiscoDevice SystemMemory Pool Utilization
v Huawei MemoryUtilization
v JuniperChassis BufferUtilization
v JuniperERX MemoryUtilization
Temperature (celsius) v CiscoDevice TemperatureLevel
v Huawei Temperature Level
v JuniperChassisTemperature
For more information, see Supported Cisco IP SLA formulas section in IBM NetworkPerformance Insight: References.
Chapter 4. Dashboard reference 93
94 Network Performance Insight References
Chapter 5. SNMP formulas
Detailed information about the SNMP formulas and their structure in NetworkPerformance Insight.
This information is intended for Network Administrators who must understandthe in-built formulas and their structure. The administrators can modify theformulas or use this information for data validation and interpretation.
See the following sections:
IP SLA formulas
These formulas are used by the Formula Service to create poll definitionrequests for the SNMP Collector Service to start the polling. FormulaService detects new IP SLA Probes or deactivates probes and sets upSNMP Collector for metric collection. Storage Service writes these metricsfrom Kafka topics to the database.
Currently, the Formula Service supports SNMP data from Cisco IPSLAdevices only.
For more information about the Formula Service and SNMP Collector Service,see IBM Network Performance Insight: Product Overview.
Performance Metric OOTB Device Support formulas
The Performance Metric OOTB Device Support provides the performancemetrics with predefined formulas for the following vendor devices andtheir supported MIB files:v Ciscov Juniperv Huawei
For more information about the Performance Metric OOTB Device Support, see IBMNetwork Performance Insight: Product Overview.
Supported Cisco IP SLA formulasUse information to understand the supported metrics that is polled by the IP SLAenabled devices in your network.
The Network Performance Insight Formula Service calculates metric values for thedata that is collected by SNMP Collector. It uses formulas that are deployedagainst specific entity types.
Metrics that are derived from these formulas give insight on the impact of networktraffic load on overall quality of latency sensitive network services. For example,voice call and video streaming quality. Typically, IP SLA handles the followingtypes of metrics:v Delayv Packet Lossv Jitterv Packet Sequence
© Copyright IBM Corp. 2015, 2018 95
v Connectivityv Pathv Downtime
Metric names are the same as the names of the formulas that generate them in thepoll definition. The following tables provide metrics that are related to different IPSLA operations in Network Performance Insight:v HTTPv Jitterv VoIPv RTPv UDP Echo
Formulas
Table 6. Entity Type: cisco.probe.http
Metric Formula Units Description
httpDnsRtt rttMonLatestHTTPOperDNSRTT Milliseconds The sum of RTT toperform a Domain NameServer Query (DNS)within the HTTPoperations.
httpRtt rttMonLatestHTTPOperRTT Milliseconds If a successful test iscompleted since the lastpoll, return the sum ofthe round-trip time (RTT)of successful HTTPoperations.
httpTcpConnectRtt rttMonLatestHTTPOperTCPConnectRTT Milliseconds The sum of RTT taken toperform a TCPconnection to the HTTPserver.
httpTransactionRtt rttMonLatestHTTPOperTransactionRTT Milliseconds The sum of Round TripTime (RTT) taken todownload the object thatis specified by URLwithin HTTP operations.
httpTransactionFailed 100 *(not(rttMonLatestHTTPOperSense==""))
Percent The percentage of requestthat has HTTP errorswhen downloading thebase page within HTTPoperations. If no errorsreturn 0, otherwise return100.
httpTransactionSucceeded 100 *((rttMonLatestHTTPOperSense==""))
Percent The percentage of requestthat had no HTTP errorswhen downloading thebase page within HTTPoperations. If no errorsreturn 100, otherwisereturn 0.
96 Network Performance Insight References
Table 7. Entity Type: cisco.probe.jitter
Metric Formula Units Description
jitterAvgInbound (rttMonLatestJitterOperSumOfPositivesDS+rttMonLatestJitterOperSumOfNegativesDS)/(rttMonLatestJitterOperNumOfRTT - 1)
Milliseconds If a successful probe issent since the last poll,return the averageinbound jitter.
jitterMaxNegativeInbound rttMonLatestJitterOperMaxOfNegativesDS Milliseconds If a successful probe issent since the last poll,return the maximuminbound negative jitter.
jitterPacketLossInbound 100 *rttMonLatestJitterOperPacketLossDS /rttMonEchoAdminNumPackets
Percent If a test is completedsince the last poll, returnthe percentage of inboundpackets lost.
jitterMaxPositiveInbound rttMonLatestJitterOperMaxOfPositivesDS Milliseconds If a successful probe issent since the last poll,return the maximuminbound positive jitter.
jitterSucceeded 100 *rttMonLatestJitterOperNumOfRTT/ rttMonEchoAdminNumPackets
Milliseconds If a successful probe issent since the last poll,return the averageoutbound jitter.
jitterMaxNegativeOutbound rttMonLatestJitterOperMaxOfNegativesSD Milliseconds If a successful probe issent since the last poll,return the maximumoutbound negative jitter.
jitterPacketLossOutbound 100 *rttMonLatestJitterOperPacketLossSD /rttMonEchoAdminNumPackets
Percent If a test is completedsince the last poll, returnthe percentage ofoutbound packets lost.
jitterMaxPositiveOutbound rttMonLatestJitterOperMaxOfPositivesSD Milliseconds If a successful probe issent since the last poll,return the maximumoutbound positive jitter.
jitterPacketCount rttMonEchoAdminNumPackets Number If a test is completedsince the last poll, returnthe number of sentprobes, otherwise return0.
jitterPacketLoss rttMonEchoAdminNumPackets Percent If a test is completedsince the last poll, returnthe number of sentprobes, otherwise return0.
jitterAvgOutbound (rttMonLatestJitterOperRTTSum2 /rttMonLatestJitterOperNumOfRTT -((rttMonLatestJitterOperRTTSum /rttMonLatestJitterOperNumOfRTT) ^ 2))^ 0.5
Milliseconds If a successful probe issent since the last poll,return the standarddeviation of theround-trip time.
jitterPacketLossUnknown 100 *rttMonLatestJitterOperPacketMIA /rttMonEchoAdminNumPackets
Percent If a test is completedsince the last poll, returnthe percentage of packetsthat are lost where thedirection is unknown.
Chapter 5. SNMP formulas 97
Table 7. Entity Type: cisco.probe.jitter (continued)
Metric Formula Units Description
jitterAvgInboundOneWay rttMonLatestJitterOperOWSumDS /rttMonLatestJitterOperNumOfRTT
Milliseconds The average of the delaysthat travel fromdestination to source forall the probes during thelast test.
jitterAvgOutboundOneWay rttMonLatestJitterOperOWSumSD1 /rttMonLatestJitterOperNumOfRTT
Milliseconds The average of the delaysthat travel from source todestination for all theprobes during the lasttest.
Table 8. Entity Type: cisco.probe.voip
Metric Formula Units Description
voipIcpif rttMonLatestJitterOperICPIF Number The maximum of allCalculated PlanningImpairment Factor (ICPIF)value for the jitteroperations.
voipMos rttMonLatestJitterOperMOS / 100 Number The maximum of allMean Opinion Score(MOS) value for the jitteroperations.
jitterAvgInbound (rttMonLatestJitterOperSumOfPositivesDS +rttMonLatestJitterOperSumOfNegativesDS) /(rttMonLatestJitterOperNumOfRTT - 1)
Milliseconds If a successful probe issent since the last poll,return the averageinbound jitter.
jitterMaxNegativeInbound rttMonLatestJitterOperMaxOfNegativesDS Milliseconds If a successful probe issent since the last poll,return the maximuminbound negative jitter.
jitterPacketLossInbound 100 *rttMonLatestJitterOperPacketLossSD/ rttMonEchoAdminNumPackets
Percent If a test is completedsince the last poll, returnthe percentage of inboundpackets lost.
jitterMaxPositiveInbound rttMonLatestJitterOperMaxOfPositivesDS Milliseconds If a successful probe issent since the last poll,return the maximuminbound positive jitter.
jitterSucceeded 100 *rttMonLatestJitterOperNumOfRTT /rttMonEchoAdminNumPackets
Milliseconds If a successful probe issent since the last poll,return the averageoutbound jitter.
jitterMaxNegativeOutbound rttMonLatestJitterOperMaxOfNegativesSD Milliseconds If a successful probe issent since the last poll,return the maximumoutbound negative jitter.
jitterPacketLossOutbound 100 *rttMonLatestJitterOperPacketLossSD /rttMonEchoAdminNumPackets
Percent If a test is completedsince the last poll, returnthe percentage ofoutbound packets lost.
98 Network Performance Insight References
Table 8. Entity Type: cisco.probe.voip (continued)
Metric Formula Units Description
jitterMaxPositiveOutbound rttMonLatestJitterOperMaxOfPositivesSD Milliseconds If a test is completedsince the last poll, returnthe percentage ofoutbound packets lost.
jitterPacketCount rttMonEchoAdminNumPackets Number If a test is completedsince the last poll, returnthe number of sentprobes, otherwise return0.
jitterPacketLoss rttMonEchoAdminNumPackets Percent If a test is completedsince the last poll, returnthe percentage of probeslost.
jitterAvgOutbound (rttMonLatestJitterOperRTTSum2 /rttMonLatestJitterOperNumOfRTT -((rttMonLatestJitterOperRTTSum /rttMonLatestJitterOperNumOfRTT) ^ 2))^ 0.5
Milliseconds If a successful probe issent since the last poll,return the standarddeviation of theround-trip time.
jitterPacketLossUnknown 100 *rttMonLatestJitterOperPacketMIA /rttMonEchoAdminNumPackets
Percent If a test is completedsince the last poll, returnthe percentage of packetsthat are lost where thedirection is unknown.
jitterAvgInboundOneWay rttMonLatestJitterOperOWSumDS /rttMonLatestJitterOperNumOfRTT
Milliseconds The average of the delaysthat travel fromdestination to source forall the probes during thelast test.
jitterAvgOutboundOneWay rttMonLatestJitterOperOWSumSD /rttMonLatestJitterOperNumOfRTT
Milliseconds The average of the delaysthat travel from source todestination for all theprobes during the lasttest.
Table 9. Entity Type: cisco.probe.rtp
Metric Formula Units Description
rtpAvgInbound rttMonLatestRtpOperAvgOWDS Milliseconds If a successful probe issent since the last poll,return the maximuminbound time.
rtpEarlyPacketsInbound 100 *rttMonLatestRtpOperPacketEarlyDS /rttMonLatestRtpOperTotalPaksDS
Percent Number of early packetsat source for the latestoperation.
rtpFrameLossInbound rttMonLatestRtpOperFrameLossDS Percent If a test is completedsince the last poll, returnthe percentage of inboundframe lost.
rtpInterArrivalJitterInbound rttMonLatestRtpOperIAJitterDS Milliseconds If a successful probe issent since the last poll,return the maximuminbound jitter.
Chapter 5. SNMP formulas 99
Table 9. Entity Type: cisco.probe.rtp (continued)
Metric Formula Units Description
rtpLatePacketsInbound 100 *rttMonLatestRtpOperPacketLateDS /rttMonLatestRtpOperTotalPaksDS
Percent Number of late packets atsource for the latestoperation.
rtpMosCqInbound rttMonLatestRtpOperMOSCQDS Number The average estimatedinbound Mean OpinionScore for ConversationalQuality (MOS-CQ).
rtpMosLqInbound rttMonLatestRtpOperMOSLQDS Number The average estimatedinbound Mean OpinionScore for ListeningQuality (MOS-LQ).
rtpPacketLossInbound 100 *rttMonLatestRtpOperPacketLossDS /rttMonLatestRtpOperTotalPaksDS
Percent If a test is completedsince the last poll, returnthe percentage of inboundpackets lost.
rtpRFactorInbound rttMonLatestRtpOperRFactorDS Number The average of estimatedvoice quality value that istransmitted fromdestination to source forthe RTP operation.
rtpAvgOutbound rttMonLatestRtpOperAvgOWSD Milliseconds If a successful probe issent since the last poll,return the maximumoutbound time.
rtpInterArrivalJitterOutboundrttMonLatestRtpOperIAJitterSD.%I1 * Milliseconds If a successful probe issent since the last poll,return the maximumoutbound jitter.
rtpMosCqOutbound rttMonLatestRtpOperMOSCQSD Number The average estimatedoutbound Mean OpinionScore for ConversationalQuality (MOS-CQ).
rtpPacketLossOutbound 100 *rttMonLatestRtpOperPacketLossSD /rttMonLatestRtpOperTotalPaksSD
Percent If a test is completedsince the last poll, returnthe percentage ofoutbound packets lost.
rtpRFactorOutbound rttMonLatestRtpOperRFactorSD Number The average of estimatedvoice quality value that istransmitted from sourceto destination for the RTPoperation.
rtpRtt rttMonLatestRtpOperRTT Milliseconds If a successful test iscompleted since the lastpoll, return the round-triptime.
rtpPacketLossUnknown 100 *rttMonLatestRtpOperPacketsMIA /rttMonLatestRtpOperTotalPaksSD
Percent If a test is completedsince the last poll, returnthe percentage of packetsthat are lost where thedirection is unknown.
100 Network Performance Insight References
Table 10. Entity Type: cisco.probe.echo
Metric Formula Units Description
echoProbeCount not(rttMonLatestRttOperTime ==last(rttMonLatestRttOperTime))
Number If a test is completed sincethe last poll, return 1,otherwise return 0.
echoProbeLoss 100 *not(rttMonLatestRttOperSense == 1)
Percent If a test is completed sincethe last poll, return thepercentage of probes lost.
echoProbeSucceeded 100 * (rttMonLatestRttOperSense == 1) Percent If a test is completed sincethe last poll, return thepercentage of probes thatsucceeded.
echoRtt rttMonLatestRttOperCompletionTime Milliseconds If a successful test iscompleted since the lastpoll, return the round-triptime.
Note: The echo operation covers the following SLA test types:v echo
v tcpConnect
v udpEcho
Supported Performance Metric OOTB Device Support discovery agents
The object identifiers (OID) explains how SNMP values are retrieved from adevice, and stored. The discovery agents use the formula service to calculate metricvalues for the data that is collected by SNMP Collector.
The following columns in the tables provide the reference information on thereports for the selected vendor type.v Discovery Agent Name
The discovery agent name for the specific vendor.v Entity Name
Specifies the entity name of the discovery agent.v Poll Definition
Specifies the metric name. Metric names are the same as the names of theformulas that generate them, the poll definition.
v Discovery FormulaSpecifies the discovery formula that is used for the metric calculation of anentity.
Table 11. Discovery Agent
DiscoveryAgent Name Entity Name Poll Definition Discovery Formula
PODS_Cisco_Processor
Processor Name
<IP>_ProcessorName:<cpmCPUTotalIndex>
CiscoDeviceSystem CPUUtilization CPM
if found(OID(cpmCPUTotal5min)or OID(cpmCPUTotal5minRev))
Chapter 5. SNMP formulas 101
Table 11. Discovery Agent (continued)
DiscoveryAgent Name Entity Name Poll Definition Discovery Formula
PODS_Cisco_Envmon
Power Supply
<IP>_PowerSupply:<ciscoEnvMonSupplyStatusIndex>
CiscoDevicePower Supply State
OID(ciscoEnvMonSupplyState !=5)
Voltage Test Point
<IP>_VoltageTestPoint:<ciscoEnvMonVoltageStatusIndex>
CiscoDeviceVoltage Level
OID(ciscoEnvMonVoltageStatusDescr)
Fan Unit
<IP>_FanUnit:<ciscoEnvMonFanStatusIndex>
CiscoDeviceFan State
OID(ciscoEnvMonFanStatusDescr)
Temperature Test Point
<IP>_TemperatureTestPoint:<ciscoEnvMonTemperatureStatusIndex>
CiscoDeviceTemperature Level
OID(ciscoEnvMonTemperatureState != 5)
PODS_Cisco_Memory_Pool
Memory Pool
<IP>_MemoryPool:<ciscoMemoryPoolType>
v CiscoDeviceSystem Memory PoolLargest Free
v CiscoDeviceSystem Memory PoolFree
v CiscoDeviceSystem Memory PoolUtilization
OID(ciscoMemoryPoolValid == 1)
PODS_Cisco_Entity_Sensor
ASR Nexus Environment
<IP>_ASR_Nexus_Environment:<entPhysicalIndex>
v CiscoDeviceNexus Current Level
v CiscoDeviceASR Nexus Fan State
(if OID(entSensorType==5)and found OID(entSensorStatus))OR(OID(entPhysicalClass == 7) andfound OID(cefcFanTrayOperStatus))
102 Network Performance Insight References
Table 11. Discovery Agent (continued)
DiscoveryAgent Name Entity Name Poll Definition Discovery Formula
PODS_Cisco_Enhanced_Mempool
Enhanced Memory Pool
<IP>_Enhanced_Memory_Pool:<ciscoMemoryPoolType><cempMemPoolIndex>
v CiscoDeviceMemory Pool In Use
v CiscoDeviceMemory PoolUnsuccessfulDeAllocations
v CiscoDeviceMemory PoolSuccessfulDeAllocations
v CiscoDeviceMemory PoolLargest Free Block
v CiscoDeviceMemory Pool Free
v CiscoDeviceMemory PoolUnsuccessfulAllocations
v CiscoDeviceMemory PoolSuccessfulAllocations
v CiscoDeviceMemory PoolUtilization
OID(cempMemPoolType)
Chapter 5. SNMP formulas 103
Table 11. Discovery Agent (continued)
DiscoveryAgent Name Entity Name Poll Definition Discovery Formula
PODS_Huawei_Entity
Huawei Modules
<IP>_Huawei_Modules:<entPhysicalIndex>
v HuaweiCPU Utilization
v HuaweiMemory Utilization
v HuaweiModule State
v HuaweiPower Supply State
v HuaweiTemperature Level
v HuaweiVoltage Level
(OID(entPhysicalClass == 9) ANDOID(entPhysicalDescr like "*Board")AND found OID(hwEntityCpuUsageThreshold))
OR
(OID((entPhysicalClass == 9) OROID(entPhysicalClass== 7))ANDOID((entPhysicalDescr like "FAN*")OR (entPhysicalDescr like "Fan*"))AND found OID(entPhysicalDescr)AND found OID(entPhysicalName))
OR
(OID(entPhysicalClass == 9) ANDOID(entPhysicalDescr like "*Board")AND(found OID(hwEntityMemSize)ORfound OID(hwEntityMemUsageThreshold)))
OR
(OID((entPhysicalClass == 9) OROID(entPhysicalClass. == 6))ANDOID((entPhysicalDescr like "POWER*")OROID(entPhysicalDescr like "Power*"))
AND found OID(entPhysicalDescr)AND found OID(entPhysicalName))
OR
(OID(entPhysicalClass == 9) ANDOID(entPhysicalDescr like "*Board")AND(foundOID(hwEntityTemperatureThreshold)ORfoundOID(hwEntityTemperatureLowThreshold)))
OR
(OID(entPhysicalClass == 9) ANDOID(entPhysicalDescr like "*Board")AND(foundOID(hwEntityVoltageLowThreshold)ORfoundOID(hwEntityVoltageHighThreshold)))
104 Network Performance Insight References
Table 11. Discovery Agent (continued)
DiscoveryAgent Name Entity Name Poll Definition Discovery Formula
PODS_Juniper_System
Juniper ERX Module
<IP>_JuniperERXModule:<juniSystemSlotNumber><juniSystemSlotLevel>
v JuniperERXCPU Utilization
v JuniperERXMemory Utilization
OID(juniSystemSlotStatus == 4) AND((OID(juniSystemSlotType == 1) OROID(juniSystemSlotType == 2) OROID(juniSystemSlotType == 16) OROID(juniSystemSlotType == 17) OROID(juniSystemSlotType == 18)) ANDfoundOID(juniSystemModuleCurrentType)
PODS_Juniper_Chassis
Chassis or FPC or PIC
<IP>_Chassis/FPC/PIC:<jnxOperatingContentsIndex><jnxOperatingL1Index><jnxOperatingL2Index><jnxOperatingL3Index>
v JuniperChassisBuffer Utilization
v JuniperChassisCPU ServiceInterrupt Utilization
v JuniperChassisCPU Utilizationavg last 5min
v JuniperChassisHeap Utilization
v JuniperChassisTemperature
if ( OID(jnxOperatingDescr) like("*temp sensor*" or "SSB*" or "SCB*"or "SFM*"or "FEB*" or "FPC*" or"PIC* or "midplane")thenskipnext
if( OID(jnxContainersLevel.<jnxOperatingContentsIndex>) ) = 0containerlevel ="Chassis"m_EntPhysName =OID(jnxFilledDescr)m_EntPhysicalDescr =OID(jnxFilledDescr)end
if( OID(jnxContainersLevel) ) = 1containerlevel = "FPC"m_EntPhysName =OID(jnxFilledDescr)m_EntPhysicalDescr =OID(jnxFilledDescr)
end
if( OID(jnxContainersLevel) ) = 2containerlevel = "PIC"m_EntPhysName =OID(jnxFilledDescr)m_EntPhysicalDescr =OID(jnxFilledDescr)end
Supported Performance Metric OOTB Device Support formulas
The pre-loaded device performance metrics that are polled from the supportedvendor devices.
The formula service calculates metric values for the data that is collected by SNMPCollector. It uses formulas that are deployed against specific entity types.
Chapter 5. SNMP formulas 105
Reports contain metrics that are generated by the formulas according to thevendor-specific ready-to-use performance packs:v SNMP RFC MIB II Devicev Juniper Devicev Cisco Devicev Huawei SNMP Device
The following columns in the tables provide the reference information on thereports for the selected vendor type.v Poll Definition
Specifies the metric name. Metric names are the same as the names of theformulas that generate them, the poll definition.
v UnitSpecifies in which unit the value is populated in the report.
v FormulaSpecifies the formula that is used for the metric calculation.
v DescriptionProvides a brief description on the formula calculation. For metrics that arelisted in a particular report, the description of the associated formula can be seenfrom the description column in the table.
RFC MIB-IIThis topic provides information on the supported metrics that are polled by SNMPRFC MIB-II.
Reports contain metrics that are generated by the formulas. The table lists thedetails for the following supported entity types for RFC MIB-II:1. Entity Type: Chassis2. Entity Type: Interface
Table 12. Entity Type: Chassis
Poll Definition Unit Formula Description
RFCMIBIIFragmentation Failures
Number 100*(eval(int,"&SNMP.DELTA.ipFragFails")/eval(int,"&SNMP.DELTA.sysUpTime"))
(PODS) The number of IPdatagrams that is discardedbecause they needed to befragmented at this entity butmight not be.
Note: PODS is an abbreviationfor Performance Metric OOTBDevice Support
RFCMIBIIICMP Messages Receivedper second
Number 100*(eval(int,"&SNMP.DELTA.icmpInMsgs")/eval(int,"&SNMP.DELTA.sysUpTime"))
(PODS) The total number ofICMP messages received bythis entity.
RFCMIBIIICMP Messages Sentper second
Number 100*(eval(int,"&SNMP.DELTA.icmpOutMsgs")/eval(int,"&SNMP.DELTA.sysUpTime"))
(PODS) The total number ofICMP messages, which theentity attempted to send.
106 Network Performance Insight References
Table 12. Entity Type: Chassis (continued)
Poll Definition Unit Formula Description
RFCMIBIIIP Out Requestper second
Number 100*(eval(int,"&SNMP.DELTA.ipOutRequests")/eval(int,"&SNMP.DELTA.sysUpTime"))
(PODS) The total number of IPdatagrams are supplied to IPfor transmission by the localIP user-protocols (includingICMP).
RFCMIBIIIP Packets Forwardedper second
Number 100*(eval(int,"&SNMP.DELTA.ipForwDatagrams")/eval(int,"&SNMP.DELTA.sysUpTime"))
(PODS) The number of inputdatagrams for this entity wasnot their final IP destination.
RFCMIBIIIP Packets Receivedper second
Number 100*(eval(int,"&SNMP.DELTA.ipInReceives")/eval(int,"&SNMP.DELTA.sysUpTime"))
(PODS) The total number ofinput datagrams are receivedfrom interfaces, includingthose input datagrams in error.
RFCMIBIINo Routeper second
Number 100*(eval(int,"&SNMP.DELTA.ipOutNoRoutes")/eval(int,"&SNMP.DELTA.sysUpTime"))
(PODS) The number of IPdatagrams that are discardedbecause no route might befound to transmit them totheir destination.
RFCMIBIIPing Replies Receivedper second
Number 100*(eval(int,"&SNMP.DELTA.icmpInEchoReps")/eval(int,"&SNMP.DELTA.sysUpTime"))
(PODS) The total number ofICMP echoes reply messages.
RFCMIBIIPing Replies Sentper second
Number 100*(eval(int,"&SNMP.DELTA.icmpOutEchoReps")/eval(int,"&SNMP.DELTA.sysUpTime"))
(PODS) The total number ofICMP echoes reply messagesthat are sent.
RFCMIBIIPing Sentper second
Number 100*(eval(int,"&SNMP.DELTA.icmpOutEchos")/eval(int,"&SNMP.DELTA.sysUpTime"))
(PODS) The total number ofICMP echo requests (ping).
RFCMIBIIPings Receivedper second
Number 100*(eval(int,"&SNMP.DELTA.icmpInEchos")/eval(int,"&SNMP.DELTA.sysUpTime"))
(PODS) The total number ofICMP echo request (ping)messages received.
RFCMIBIIReassembly Failuresper second
Number 100*(eval(int,"&SNMP.DELTA.ipReasmFails")/eval(int,"&SNMP.DELTA.sysUpTime"))
(PODS) The number of failuresthat are detected by the IPreassembly algorithm (such astime out, errors and etc).
Table 13. Entity Type: Interface
Poll Definition Unit Formula Description
RFCMIBIIDelivered UMB HC
Packets eval(int,"&SNMP.DELTA.ifHCInUcastPkts")+ eval(int,"&SNMP.DELTA.ifHCInMulticastPkts")+ eval(int,"&SNMP.DELTA.ifHCInBroadcastPkts")
(PODS) The total number ofpackets that are delivered to ahigher layer, during the lastpolling period. This metricexcludes any packets that werereceived by an interface, butwere not passed on.
Chapter 5. SNMP formulas 107
Table 13. Entity Type: Interface (continued)
Poll Definition Unit Formula Description
RFCMIBIIDelivered UMB LC
Packets eval(int,"&SNMP.DELTA.ifInUcastPkts")+ eval(int,"&SNMP.DELTA.ifInMulticastPkts")+ eval(int,"&SNMP.DELTA.ifInBroadcastPkts")
(PODS) The total number ofpackets that are delivered to ahigher layer, during the lastpolling period. This metricexcludes any packets that werereceived by an interface, butwere not passed on.
RFCMIBIIDelivered UNU
Packets eval(int,"&SNMP.DELTA.ifInUcastPkts")+ eval(int,"&SNMP.DELTA.ifInNUcastPkts")
(PODS) The total number ofpackets that are delivered to ahigher layer, during the lastpolling period. This metricexcludes any packets that werereceived by an interface, butwere not passed on.
RFCMIBIIInbound BroadcastHC pps
Packetspersecond
eval(long64,"&SNMP.DELTA.ifHCInBroadcastPkts")/ eval(long64,"&POLL.POLLINTERVAL")
(PODS) The rate, per second,at which the inboundbroadcast packets at this layerwere delivered to a higherlayer, during the last pollingperiod.
RFCMIBIIInbound BroadcastLC pps
Packetspersecond
eval(long64,"&SNMP.DELTA.ifInBroadcastPkts")/ eval(long64,"&POLL.POLLINTERVAL")
(PODS) The rate, per second,at which the inboundbroadcast packets at this layerwere delivered to a higherlayer, during the last pollingperiod.
RFCMIBIIInbound MulticastHC pps
Packetspersecond
eval(long64,"&SNMP.DELTA.ifHCInMulticastPkts")/eval(long64,"&POLL.POLLINTERVAL")
(PODS) The rate, per second,at which the inboundmulticast packets at this layerwere delivered to a higherlayer, during the last pollingperiod.
RFCMIBIIInbound MulticastLC pps
Packetspersecond
eval(long64,"&SNMP.DELTA.ifInMulticastPkts ")/ eval(long64,"&POLL.POLLINTERVAL")
(PODS) The rate, per second,at which the inboundmulticast packets at this layerwere delivered to a higherlayer, during the last pollingperiod.
RFCMIBIIInbound NonUnicastpps
Packetspersecond
eval(long64,"&SNMP.DELTA.ifInNUcastPkts")/ eval(long64,"&POLL.POLLINTERVAL")
(PODS) The rate, per second,at which non-unicast packetsat this layer were delivered toa higher layer during the lastpolling period.
This formula usesifInNUcastPkts, which has noHC equivalent so there are noLC/HC variants of theformula.Note: The InboundNon-Unicast (pps) formulamaps to the same Genericformula as the SNMPMulticast collection formulas.
108 Network Performance Insight References
Table 13. Entity Type: Interface (continued)
Poll Definition Unit Formula Description
RFCMIBIIInbound ThroughputHC bps
Bits persecond
8*eval(long64,"&SNMP.DELTA.ifHCInOctets")/ eval(long64,"&POLL.POLLINTERVAL")
(PODS) The average rate, inbits-per-second, of inboundtraffic on this resource duringthe last polling period.
RFCMIBIIInbound ThroughputLC bps
Bits persecond
8*eval(long64,"&SNMP.DELTA.ifInOctets")/eval(long64,"&POLL.POLLINTERVAL")
(PODS) The average rate, inbits-per-second, of inboundtraffic on this resource duringthe last polling period.
RFCMIBIIInbound UnicastHC pps
Packetspersecond
eval(long64,"&SNMP.DELTA.ifHCInUcastPkts")/eval(long64,"&POLL.POLLINTERVAL")
(PODS) The rate, per second,at which inbound packetswere received, and deliveredto a higher layer during thelast polling period. Thecalculation does not includepackets that are addressed to amulticast or broadcast addressat this layer.
RFCMIBIIInbound UnicastLC pps
Packetspersecond
eval(long64,"&SNMP.DELTA.ifInUcastPkts")/eval(long64,"&POLL.POLLINTERVAL")
(PODS) The rate, per second,at which inbound packetswere received, and deliveredto a higher layer during thelast polling period. Thecalculation does not includepackets that are addressed to amulticast or broadcast addressat this layer.
RFCMIBIIInbound UtilizationHC percent
Percentage 100*(((8*eval(long64,"&SNMP.DELTA.ifHCInOctets"))/eval(long64,"&POLL.POLLINTERVAL"))/ eval(long64,"&SNMP.VALUE.ifSpeed"))
(PODS) The averagepercentage of the inboundbandwidth (capacity) used onthis interface during the lastpolling period. The percentageis valid only if the interfacehas a defined bandwidth (thatis, ifSpeed is nonzero).
RFCMIBIIInbound UtilizationHCHS percent
Percentage (((8*eval(long64,"&SNMP.DELTA.ifHCInOctets"))/eval(long64,"&POLL.POLLINTERVAL"))/eval(long64,"&SNMP.VALUE.ifHighSpeed"))/10000
(PODS) The averagepercentage of the inboundbandwidth (capacity) used onthis interface during the lastpolling period. The percentageis valid only if the interfacehas a defined bandwidth (thatis, ifSpeed is nonzero).
RFCMIBIIInbound VolumeHC octets
Octets eval(int,"&SNMP.DELTA.ifHCInOctets")
(PODS) The number of octets(bytes) received on thisinterface since the lastsuccessful retrieval of thisvalue.
RFCMIBIIInbound VolumeLC octets
Octets eval(int,"&SNMP.DELTA.ifInOctets")
(PODS) The number of octets(bytes) received on thisinterface since the lastsuccessful retrieval of thisvalue.
Chapter 5. SNMP formulas 109
Table 13. Entity Type: Interface (continued)
Poll Definition Unit Formula Description
RFCMIBIIOutbound BroadcastHC pps
Packetspersecond
eval(long64,"&SNMP.DELTA.ifHCOutBroadcastPkts")/ eval(long64,"&POLL.POLLINTERVAL")
(PODS) The rate, per second,at which the outboundbroadcast packets at this layerwere delivered to a higherlayer, during the last pollingperiod. The delivered packetsinclude those packets thatwere dropped and nottransmitted.
RFCMIBIIOutbound BroadcastLC pps
Packetspersecond
eval(long64,"&SNMP.DELTA.ifOutBroadcastPkts")/eval(long64,"&POLL.POLLINTERVAL")
(PODS) The rate, per second,at which the outboundbroadcast packets at this layerwere delivered to a higherlayer, during the last pollingperiod. The delivered packetsinclude those packets thatwere dropped and nottransmitted.
RFCMIBIIOutbound MulticastHC pps
Packetspersecond
eval(long64,"&SNMP.DELTA.ifHCOutMulticastPkts")/ eval(long64,"&POLL.POLLINTERVAL")
(PODS) The rate, per second,at which the outboundmulticast packets weredelivered to this interface,during the last polling period.These packets include packetsthat were dropped and nottransmitted.
RFCMIBIIOutbound MulticastLC pps
Packetspersecond
eval(long64,"&SNMP.DELTA.ifOutMulticastPkts")/eval(long64,"&POLL.POLLINTERVAL")
(PODS) The rate, per second,at which the outboundmulticast packets weredelivered to this interface,during the last polling period.These packets include packetsthat were dropped and nottransmitted.
RFCMIBIIOutbound NonUnicastpps
Packetspersecond
eval(long64,"&SNMP.DELTA.ifOutNUcastPkts")/eval(long64,"&POLL.POLLINTERVAL")
(PODS) The rate, per second,at which non-unicast packetsat this layer were delivered tothis interface during the lastpolling period.
This formula usesifOutNUcastPkts, which hasno HC equivalent so there areno LC/HC variants of theformula.
Note: The OutboundNon-Unicast (pps) formulamaps to the same Genericformula as the SNMPMulticast collection formulas.
RFCMIBIIOutbound ThroughputHC bps
Bits persecond
8*eval(long64,"&SNMP.DELTA.ifHCOutOctets")/eval(long64,"&POLL.POLLINTERVAL")
(PODS) The average rate, inbits-per-second, of outboundtraffic on this resource duringthe last polling period.
110 Network Performance Insight References
Table 13. Entity Type: Interface (continued)
Poll Definition Unit Formula Description
RFCMIBIIOutbound ThroughputLC bps
Bits persecond
8*eval(long64,"&SNMP.DELTA.ifOutOctets")/eval(long64,"&POLL.POLLINTERVAL")
(PODS) The average rate, inbits-per-second, of outboundtraffic on this resource duringthe last polling period.
RFCMIBIIOutbound UnicastHC pps
Packetspersecond
eval(long64,"&SNMP.DELTA.ifHCOutUcastPkts")/eval(long64,"&POLL.POLLINTERVAL")
(PODS) The rate, per second,at which outbound packetswere presented to thisinterface during the lastpolling period. The calculationdoes not include packetsaddressed to a multicast orbroadcast address at this layer,but does include droppedpackets that were nottransmitted.
RFCMIBIIOutbound UnicastLC pps
Packetspersecond
eval(long64,"&SNMP.DELTA.ifOutUcastPkts")/eval(long64,"&POLL.POLLINTERVAL")
(PODS) The rate, per second,at which outbound packetswere presented to thisinterface during the lastpolling period. The calculationdoes not include packets thatare addressed to a multicast orbroadcast address at this layer,but does include droppedpackets that were nottransmitted.
RFCMIBIIOutbound UtilizationHC percent
Percentage 100*(((8*eval(long64,"&SNMP.DELTA.ifHCOutOctets"))/eval(long64,"&POLL.POLLINTERVAL"))/ eval(long64,"&SNMP.VALUE.ifSpeed"))
(PODS) The averagepercentage of the outboundbandwidth (capacity) used onthis resource on this interfaceduring the last polling period.This percentage is valid only ifthe interface has a definedbandwidth, that is, the ifSpeedOID (defined in theRFC1213-MIB) is nonzero.
RFCMIBIIOutbound UtilizationHCHS percent
Percentage (((8*eval(long64,"&SNMP.DELTA.ifHCOutOctets"))/eval(long64,"&POLL.POLLINTERVAL"))/eval(long64,"&SNMP.VALUE.ifHighSpeed"))/10000
(PODS) The averagepercentage of the outboundbandwidth (capacity) used onthis resource on this interfaceduring the last polling period.This percentage is valid only ifthe interface has a definedbandwidth, that is, the ifSpeedOID (defined in theRFC1213-MIB) is nonzero.
RFCMIBIIOutbound VolumeHC octets
Octets eval(int,"&SNMP.DELTA.ifHCOutOctets")
(PODS) The number of octets(bytes) transmitted out of thisinterface during the lastpolling period.
RFCMIBIIOutbound VolumeLC octets
Octets eval(int,"&SNMP.DELTA.ifOutOctets")
(PODS) The number of octets(bytes) transmitted out of thisinterface during the lastpolling period.
Chapter 5. SNMP formulas 111
Table 13. Entity Type: Interface (continued)
Poll Definition Unit Formula Description
RFCMIBIITransmitted UMBDE HC
Number eval(int,"&SNMP.DELTA.ifHCOutUcastPkts")+ eval(int,"&SNMP.DELTA.ifHCOutMulticastPkts")+ eval(int,"&SNMP.DELTA.ifHCOutBroadcastPkts")- eval(int,"&SNMP.DELTA.ifOutDiscards")- eval(int,"&SNMP.DELTA.ifOutErrors")
(PODS) The total packets (allpackets) transmitted out ofthis interface during the lastpolling period.
RFCMIBIITransmitted UMBDE LC
Number eval(int,"&SNMP.DELTA.ifOutUcastPkts")+ eval(int,"&SNMP.DELTA.ifOutMulticastPkts")+ eval(int,"&SNMP.DELTA.ifOutBroadcastPkts")- eval(int,"&SNMP.DELTA.ifOutDiscards")- eval(int,"&SNMP.DELTA.ifOutErrors")
(PODS) The total packets (allpackets) transmitted out ofthis interface during the lastpolling period.
RFCMIBIITransmitted UNUDE
Number eval(int,"&SNMP.DELTA.ifOutUcastPkts")+ eval(int,"&SNMP.DELTA.ifOutNUcastPkts")- eval(int,"&SNMP.DELTA.ifOutDiscards")- eval(int,"&SNMP.DELTA.ifOutErrors")
(PODS) The total packets (allpackets) transmitted out ofthis interface during the lastpolling period.
RFCMIBIIUnknown Protocols
Number eval(int,"&SNMP.DELTA.ifInUnknownProtos")
(PODS) The number of packetsor transmission units droppedbecause of an unknown orunsupported protocol. Thevalue is returned as zero byany interface, which has noconcept of protocol.
CiscoThis topic provides information on the supported metrics that are polled by Ciscodevice.
Reports contain metrics that are generated by the formulas. The table lists thedetails for Cisco device poller.
Table 14. Cisco Device Poller
Poll Definition Unit Formula Description
CiscoDeviceSystem CPUUtilization CPM
Percentage cpmCPUTotal5minRev (PODS) The overall CPU busypercentage over the last 5-minuteperiod.
Note: PODS is an abbreviationfor Performance Metric OOTBDevice Support
112 Network Performance Insight References
Table 14. Cisco Device Poller (continued)
Poll Definition Unit Formula Description
CiscoDevicePower Supply State
Number ciscoEnvMonSupplyState (PODS) The raw value ofciscoEnvMonSupplyState, whichis an enumerated integer.
State values are as follows:
v normal (1)
v warning (2)
v critical (3)
v shutdown (4)
v notPresent (5)
v notFunctioning (6)
CiscoDeviceVoltage Level
Voltage eval(long64,"&SNMP.VALUE.ciscoEnvMonVoltageStatusValue")/1000
(PODS) Calculates the raw value,in volts, of the Voltage statusvalue from theCISCOENVMON-MIB.
The syntax format clean isrequired to ensure that negativevalues are presented correctly.
CiscoDeviceFan State
Number ciscoEnvMonFanState (PODS) Calculates the raw valueof ciscoEnvMonFanState, which isan enumerated integer.
State values are as follows:
v normal (1)
v warning (2)
v critical (3)
v shutdown (4)
v notPresent (5)
v notFunctioning (6)
CiscoDeviceTemperature Level
Celsius ciscoEnvMonTemperatureStatusValue
(PODS) Calculates the raw value,in degrees Celsius, oftemperaturestatus value.
CiscoDeviceSystem MemoryPool Largest Free
Bytes ciscoMemoryPoolLargestFree (PODS) The largest number ofcontiguous bytes from thememory pool that are currentlyunused on the managed device.
CiscoDeviceSystem Memory Pool Free
Bytes ciscoMemoryPoolFree (PODS) Indicates the number ofbytes from the memory pool thatare currently unused on themanaged device. This formulacalculates the number of bytesfrom the memory pool that arecurrently unused on themanaged device.
CiscoDeviceSystem MemoryPool Utilization
Percentage 100*eval(int,"&SNMP.VALUE.ciscoMemoryPoolUsed")/(eval(int,” ,"&SNMP.VALUE.ciscoMemoryPoolUsed")+(eval(int,” ,"&SNMP.VALUE.ciscoMemoryPoolFree"))
(PODS) The percentage of amemory pool that is used on themanaged device.
Chapter 5. SNMP formulas 113
Table 14. Cisco Device Poller (continued)
Poll Definition Unit Formula Description
CiscoDeviceNexus Current Level
Number cefcFRUCurrent (PODS) Current supplied by theFRU (positive values) or currentrequired to operate the FRU(negative values).
CiscoDeviceASR Nexus Fan State
Number cefcFanTrayOperStatus (PODS) The operational state ofthe fan.
State values are as follows:
v unknown (1)
v up(powered on) (2)
v down (powered down) (3)
v warning (partial failure, needsreplacement as soon aspossible) (4)
CiscoDeviceMemory Pool In Use
Bytes cempMemPoolUsed (PODS) Indicates the number ofbytes from the memory pool thatare currently in use byapplications on the physicalentity.
CiscoDeviceMemory PoolUnsuccessfulDeAllocations
Number cempMemPoolFreeMiss (PODS) Indicates the number ofunsuccessful attempts tofree/deallocate memory from thememory pool.
CiscoDeviceMemory PoolSuccessful DeAllocations
Number cempMemPoolFreeHit (PODS) Indicates the number ofsuccessful frees or deallocationfrom the memory pool.
CiscoDeviceMemory PoolLargest Free Block
Bytes cempMemPoolLargestFree (PODS) Indicates the largestnumber of contiguous bytes fromthe memory pool that arecurrently unused on the physicalentity.
CiscoDeviceMemory Pool Free
Number cempMemPoolFree (PODS) Indicates the number ofbytes from the memory pool thatare currently unused on thephysical entity.
CiscoDeviceMemory PoolUnsuccessful Allocations
Number cempMemPoolAllocMiss (PODS) Indicates the number ofunsuccessful allocations from thememory pool.
CiscoDeviceMemory PoolSuccessful Allocations
Number cempMemPoolAllocHit (PODS) Indicates the number ofsuccessful allocations from thememory pool.
CiscoDeviceMemory Pool Utilization
Percentage 100*eval(int,"&SNMP.VALUE.cempMemPoolUsed")/(eval(int,"&SNMP.VALUE.cempMemPoolUsed")+ eval(int,"&SNMP.VALUE.cempMemPoolFree"))
(PODS) Indicates the percentageof the enhanced memory poolthat is used on the manageddevice.
114 Network Performance Insight References
Table 14. Cisco Device Poller (continued)
Poll Definition Unit Formula Description
CiscoDeviceSystem BufferUtilization IOS10
Percentage 100 * ((eval(int,"&SNMP.VALUE.bufferSmTotal")+ eval(int,"&SNMP.VALUE.bufferMdTotal")+ eval(int,"&SNMP.VALUE.bufferBgTotal")+ eval(int,"&SNMP.VALUE.bufferLgTotal")+ eval(int,"&SNMP.VALUE.bufferHgTotal"))- (eval(int,"&SNMP.VALUE.bufferSmFree")+ eval(int,"&SNMP.VALUE.bufferMdFree")+ eval(int,"&SNMP.VALUE.bufferBgFree")+ eval(int,"&SNMP.VALUE.bufferLgFree")+ eval(int,"&SNMP.VALUE.bufferHgFree")))/ (eval(int,"&SNMP.VALUE.bufferSmTotal")+ eval(int,"&SNMP.VALUE.bufferMdTotal")+ eval(int,"&SNMP.VALUE.bufferBgTotal")+ eval(int,"&SNMP.VALUE.bufferLgTotal")+ eval(int,"&SNMP.VALUE.bufferHgTotal"))
(PODS) The percentage ofmemory buffers that are utilized,based on the number of buffersnot the amount of memory.
CiscoDeviceInbound Runts
Number locIfInRunts (PODS) The number of packetsinput, which is smaller than theallowable physical mediapermitted.
CiscoDeviceInbound Abort
Number locIfInAbort (PODS) Valid on packet-orientedinterfaces only. The number oferror-free packets droppedduring the last polling period.Packets might be dropped forcapacity reasons (no buffer space)or for traffic-shaping reasons.
CiscoDeviceInbound Frame
Number locIfInFrame (PODS) Number of inputpackets, which were misaligned.
CiscoDeviceInbound CRC
Number locIfInCRC (PODS) Number of inputpackets, which had cyclicredundancy checksum errors.
CiscoDeviceInbound Giants
Number locIfInGiants (PODS) Number of inputpackets, which were larger thanthe physical media permitted.
CiscoDeviceInbound Ignored
Number locIfInIgnored (PODS) Number of inputpackets, which were ignored bythis interface.
CiscoDeviceInbound OverRun
Number locIfInOverrun (PODS) Count of input, whicharrived too quickly for thehardware to receive.
Chapter 5. SNMP formulas 115
JuniperThis topic provides information on the supported metrics that are polled byJuniper device.
Reports contain metrics that are generated by the formulas. The table lists thedetails for Juniper device poller.
Table 15. Juniper Device Poller
Poll Definition Unit Formula Description
JuniperERXCPU Utilization
Percentage juniSystemModuleCpuUtilPct (PODS) The percentageof CPU utilization.
Note: PODS is anabbreviation forPerformance MetricOOTB Device Support
JuniperERXMemory Utilization
Percentage juniSystemModuleMemUtilPct (PODS) The percentageof total memory in useout of all memory that isallocated for the device.
JuniperChassisBuffer Utilization
Percentage jnxOperatingBuffer (PODS) The percentageof memory buffers in useat polling time.
JuniperChassisCPU Service InterruptUtilization
Percentage jnxOperatingISR (PODS) The percentageof CPU cycles that isused in interrupt serviceroutine (ISR) processing.
The value is returned aszero is its unavailable ofnon applicable.
JuniperChassisCPU Utilization avglast 5min
Percentage jnxOperatingCPU (PODS) The averagepercentage of CPUutilization that isexperienced during thelast full 5-minute,vendor-scheduled timesegment before polling.
The average busypercentage is calculatedinternally by the deviceand the sample period isfixed.
JuniperChassisHeap Utilization
Percentage jnxOperatingHeap (PODS) The percentageheap utilization of theentry.
JuniperChassisTemperature
Celsius jnxOperatingTemp (PODS) Collects thereported temperature ofthe entry, in degreesCelsius.
116 Network Performance Insight References
HuaweiThis topic provides information on the supported metrics that are polled byHuawei device.
Reports contain metrics that are generated by the formulas. The table lists thedetails for Huawei device poller.
Table 16. Huawei Device Poller
Poll Definition Unit Formula Description
HuaweiCPU Utilization
Percentage hwEntityCpuUsage (PODS) The CPU usage ofthis entity, it calculated theoverall CPU usage on theentity
Note: PODS is anabbreviation forPerformance Metric OOTBDevice Support
HuaweiMemory Utilization
Percentage hwEntityMemUsage (PODS) The memory usagefor the entity. This objectpoint out how manypercent of memory hasbeen used.
HuaweiModule State
Number hwEntityOperStatus (PODS) The status of themodule.
HuaweiPower Supply State
Number hwEntPowerUsedInfoPower
(PODS) Used power ofboard.
HuaweiTemperature Level
Celsius hwEntityTemperature (PODS) The entitytemperature.
HuaweiVoltage Level
Voltage hwEntityVoltage (PODS) The entity voltage.
Chapter 5. SNMP formulas 117
118 Network Performance Insight References
Chapter 6. Configuring Flow devices
Provides the command reference with examples for configuring the flow devices toenable them to work with IBM Network Performance Insight, Version 1.2.2.
Before Network Performance Insight can gather data, routers and other networkdevices must be configured to send NetFlow data. These configurations are neededto ensure that routers send NetFlow data periodically to the Collector subsystem.
For more detailed information about setting up flow devices for NetworkPerformance Insight, see the specific vendor documentation.
CAUTION:Only IT administrators with experience in configuring routers and switchesmust use this information.
Supported devices and flow formatsIBM Network Performance Insight, Version 1.2.2 supports most of the devices andtheir flow formats that are available in the market.
Some of devices and their flow formats that Network Performance Insight v1.2.2supports:
Device Flow format
Cisco NetFlow (v1, v5, v9, and IPFIX versions)and Flexible NetFlow with AVC
Juniper J-Flow (v5 and v9)
Alcatel Cflow (v5 and v9)
Huawei NetStream (v5 and v9)
Configuring NetFlow on Cisco routersNetflow is a data collection and reporting protocol for monitoring network trafficthat is supported by multiple vendors.
As a part of this configuration, network administrators must configure the devicesto transmit NetFlow information actively to the network monitoring applicationand configure the interfaces to gather information about the traffic conversations.The configurations that you perform must be in line with the capacity of thenetwork application. In this case, Network Performance Insight.
NetFlow also monitors layers 2-4 of Open Systems Interconnection (OSI) modeland other flow technologies and provides information on network usage and portconversations activity.Related information:
Cisco IOS Configuration Fundamentals Command Reference, Release 12.2
© Copyright IBM Corp. 2015, 2018 119
Cisco IOS command modesYou use the CLI to access Cisco IOS software.
Enter a question mark (?) at the CLI prompt to obtain a list of commands that areavailable for each command mode.
When you log in to the CLI, you are in user EXEC mode. User EXEC mode containsonly a limited subset of commands. To have access to all commands, you mustenter privileged EXEC mode, normally by using a password. From privileged EXECmode, you can give any EXEC command; user or privileged mode. Or, you canenter global configuration mode.
These configuration modes are needed for you to change the runningconfiguration. If you later save the running configuration to the start configuration,these changed commands are stored when the software is rebooted. To enterspecific configuration modes, you must start at global configuration mode. Fromglobal configuration mode, you can enter interface configuration mode and variousother modes, such as protocol-specific modes.
Command modesDescribes how to use various common command modes of the Cisco IOS software.
Command modes
Shows examples of the prompts displayed.
Command mode Command
User Exec
When you log in to the CLI, you are in UserExec mode. Contains only a limited subsetof commands.
Router>
Privileged Exec
You can have access to all commands in thismode. Typically, require a password. Use theenable command. Your prompt changes toRouter#.
Router> enablePassword <password>Router#
Global configuration
Enter the configure terminal privilegedEXEC command to enter globalconfiguration mode. Your prompt changes toRouter(config)#.
Router# configure terminalRouter(config)#
Note: Enter configuration commands, oneper line. End with CTRL+Z or Exit command.
Interface configuration
From global configuration mode, specify aninterface by using an interface command.Your prompt changes toRouter(config_if)#.Note: Enter “?” to display what you mustenter next on the command line.
Router(config)# interface serial ?<0-6> Serial interface numberRouter(config)# interface serial 4 ?/Router(config)# interface serial 4/ ?<0-3> Serial interface numberRouter(config)# interface serial 4/0Router(config-if)#
120 Network Performance Insight References
Command mode Command
ROM monitor mode
ROM monitor mode is a separate mode thatis used when the Cisco IOS software cannotload properly. From privileged EXEC mode,use the reload EXEC command. Yourprompt changes to rommon #>.
Router# reload>
Configuring Flexible NetFlow and Application Visibility andControl (AVC)
Use these configuration steps to enable your devices for the mandatory Flow fieldsand the enterprise Flow fields to support AVC solution.
About this task
AVC is integrated approach that provides application recognition and performancemonitoring capabilities to your NetFlow enabled devices. The information that iscollected by Cisco AVC is exported in an open standard format such as NetflowVersion 9 and IPFIX. These formats allow both Cisco and third-party networkmanagement to support Cisco AVC solution.
The following Cisco AVC solution components are supported in NetworkPerformance Insight:v Network-Based Application Recognition (NBAR)v Next Generation Network-Based Application Recognition (NBAR2)v Application Response Time (ART)v Quality of Service (QoS)Related information:
Configuration Examples for Flexible Netflow
Configuring standard Flow fieldsThe flow record defines the record fields that must be exported from the device tothe collector.
About this task
Standard Flow fields configuration.
Procedure1. Configure to specify where the Flow data must be exported to:
configure terminalflow exporter <NPI_exporter>destination 100.100.10.10source GigabitEthernet0/3transport udp 2050export-portocol netflow-v9# Configure this option template to support application id to name and description mappingoption application table# Configure if required to support NBAR2 for application attributesoption application attributesexit
2. Configure the Flow record to collect the Flow fields:
Chapter 6. Configuring Flow devices 121
Note: This example is for NetFlow V9 records.configure terminalflow record type performance-monitor Netflow_v9match ipv4/ipv6 tosmatch ipv4/ipv6 protocolmatch ipv4/ipv6 source addressmatch ipv4/ipv6 destination addressmatch transport source-portmatch transport destination-portmatch interface inputmatch application namecollect interface outputcollect counter bytescollect counter packetscollect flow directioncollect routing source ascollect routing destination ascollect routing next-hop address ipv4collect transport tcp flagscollect timestamp sys-uptime firstcollect timestamp sys-uptime lastexit
3. Configure the Flow monitor that creates new NetFlow cache and the requiredFlow record and Flow Exporter:configure terminalflow monitor <NPI_monitor>description Netflow v9 monitorrecord Netflow_v9exporter <NPI_Exporter>exit
4. Configure to apply the Flow Monitor to an interface:configure terminalinterface GigabitEthernet0/3ip flow monitor <NPI_monitor> inputip flow monitor <NPI_monitor> outputexit
Related information:
Cisco IOS Flexible NetFlow Command Reference
Configuring Quality of Service (QoS) on Cisco devicesQoS provides prioritization and rate-limiting of traffic. High-priority,latency-sensitive traffic can be put into the priority queue.
About this task
QoS Flow fields configuration.
Procedure1. Configure to specify where the Flow data must be exported to:
configure terminalflow exporter <NPI_monitor>destination 100.100.10.10source GigabitEthernet0/3transport udp 2050export-portocol netflow-v9option application table# NBAR fields to support application id to name and description mappingoption application attributes[Configure if required to support NBAR2 for application attributesoption c3pl-policy-table
122 Network Performance Insight References
# Configure if required to support QoS HIeararchy and Queue Drops reportingoption c3pl-class-table# Configure if required to support QoS HIeararchy and Queue Drops reportingexit
2. Configure the Flow record to collect the QoS fields:configure terminalflow record type performance-monitor Netflow_v9match ipv4/ipv6 tosmatch ipv4/ipv6 protocolmatch ipv4/ipv6 source addressmatch ipv4/ipv6 destination addressmatch transport source-portmatch transport destination-portmatch interface inputmatch application namecollect interface outputcollect counter bytescollect counter packetscollect flow directioncollect routing source ascollect routing destination ascollect routing next-hop address ipv4collect transport tcp flagscollect policy qos class hierarchycollect policy qos queue idcollect timestamp sys-uptime firstcollect timestamp sys-uptime lastexit
a. Configure the QoS Queue Drops field collection:
Note: QoS Queue Drops must be configured in a separate Flow record asmandated by Cisco. See AVC Configuration.configure terminalflow record type performance monitor QoS_Queue_Dropmatch policy qos queue indexcollect policy qos queue dropscollect interface outputcollect timestamp absolute monitoring-interval startcollect timestamp absolute monitoring-interval endexit
3. Configure the Flow monitor that creates new NetFlow cache and the requiredFlow record and Flow Exporter:configure terminalflow monitor <NPI_monitor>description Netflow v9 monitorrecord Netflow_v9exporter <NPI_monitor>exit
a. Configure the QoS monitor:configure terminalflow monitor type performance-monitor <qos_Monitor>exporter <NPI_exporter>record QoS_Queue_Dropexit
b. Configure to create Performance Monitor Policy for QoS:
Note: Ensure that the required QoS policies and classes are defined. SeeAVC Configuration.
Chapter 6. Configuring Flow devices 123
configure terminalpolicy-map type performance monitor pm-qosclass httpflow monitor qos-monitorexit
4. Configure to apply the Flow Monitor to an interface:configure terminalinterface GigabitEthernet0/3ip flow monitor NPI_monitor inputip flow monitor NPI_monitor outputservice-policy type performance monitor output pm-qosexit
Configuring Application Response Time (ART) on Cisco devicesART metrics are extracted or calculated by the ART engine. These metrics areavailable only for TCP flows.
About this task
ART Flow fields configuration.
Procedure1. Configure to specify where the Flow data must be exported to:
configure terminalflow exporter NPI_exporterdestination 100.100.10.10source GigabitEthernet0/3transport udp 2050export-portocol netflow-v9option application tableoption application attributesexit
2. Configure a separate Flow record template for Application Response Time(ART) configuration as ART records contain bi-directional data:configure terminalflow record type performance-monitor ART_recordmatch ipv4/ipv6 protocolmatch application namematch connection client ipv4 addressmatch connection server ipv4 addressmatch connection server transport portcollect ipv4/ipv6 dscpcollect interface inputcollect interface outputcollect timestamp sys-uptime firstcollect timestamp sys-uptime lastcollect connection delay network to-server maxcollect connection delay network to-client maxcollect connection delay application maxcollect connection delay response client-to-server
3. Configure the Flow monitor that creates new NetFlow cache and the requiredFlow record and Flow Exporter:configure terminalflow monitor type performance-monitor ART-monitorexporter NPI_exporterrecord ART_recordexit
4. Configure to apply the Flow Monitor to an interface:
124 Network Performance Insight References
configure terminalinterface GigabitEthernet0/3ip flow monitor ART_monitor outputexit
Enabling NetFlow on your devicesTo enable NetFlow, configure IP routing and use these commands in globalconfiguration mode.
About this task
Enabling flow monitoring for an interface.
Command Description
Router(config)# interface typeslot/port-adapter/port
Enters interface configuration mode andconfigures the interface.
For example, interfaceGigabitEthernet1/0/3
Router(config-if)# ip route-cache flow Enables NetFlow for IP routing.
Router(config-if)# ip route-cache ingressRouter(config-if)# ip route-cache egressRouter(config-if)# ip flow egressRouter(config-if)# ip flow ingress
Enables NetFlow on the sub interfaces withdirection.
Configuring the Flow ExportersNetFlow information can also be exported to network management applications.
About this task
To configure a router to export NetFlow information that is maintained in theNetFlow cache to Network Performance Insight, use these commands in globalconfiguration mode. NetFlow information is exported to Network PerformanceInsight when the Flow expires in NetFlow cache.
Command Description
Router(config)# ip flow-exportip-address udp-port
Where
<IP_address>IP address of the system to which you wantto send the NetFlow information.
udp-portUDP protocol-specific port number.
Configures a router to exportNetFlow cache entries to aCollector.Note: To disable IP routing, use theno IP routing command as: no ipflow-export.
Chapter 6. Configuring Flow devices 125
Command Description
Router(config)# ip flow-exportversion 9 [peer-as | origin-as | bgp-nexthop]
Specifies that the export packetuses the Version 9 format.Optionally, specify the origin orpeer autonomous systems.
v peer-as
Specifies that export statisticsinclude the originatingautonomous system for thesource and destination.
v origin-as
Specifies that export statisticsinclude the peer autonomoussystem for the source anddestination.
v bgp-nexthop
Specifies that export statisticsinclude BGP next hop-relatedinformation.
show ip flow export Displays statistics for the NetFlowdata export, including statistics forthe main cache and for all otherenabled caches.
Router(config)# ip flow-export source<interface>/<interface_number>
Sets the source IP address of theNetFlow exports that are sent bythe device to the specified IPaddress.
Router(config)# ip flow-cache timeout active 1 Active timeout is the frequency ofactive flow records that areexported from the flow cache toNetwork Performance Insight.Default value is 30 min. To getreal-time traffic reports, set thisvalue to 1.
Router(config)# ip flow-cache timeout inactive 15 Inactive timeout is the frequency ofinactive flow records that areexported from the flow cache toNetwork Performance Insight. Aflow record is inactive when theconversation between twointerfaces is stopped. Default valueis 15 sec.
Related information:
Configuring NetFlow and NetFlow Data Export
126 Network Performance Insight References
Customizing the number of entries in flow cacheYou can increase or decrease the number of entries that are maintained in the cacheto meet your NetFlow traffic rates. The number of entries can be 1024 - 524288.The default is 65536.
About this task
Command Description
Router(config)# ip flow-cache entries <number> Changes the number of entries thatare maintained in the NetFlowcache.
CAUTION:Improper use of this feature mightcause network problems. To returnto the default NetFlow cacheentries, use the no ip flow-cacheentries in global configurationmode.
Monitoring NetFlow informationUse these commands to verify whether the NetFlow data export is functioning anddisplaying the data.
About this task
Command Description
Router# show ip flow export Displays information aboutNetFlow flow exporters andstatistics.
Router# show flow exporter <exporter_name> Displays the statistics of thespecified Flow Exporter.
Router# show ip flow interface Displays NetFlow accountingconfiguration on interfaces.
Router# show ip interface Displays the usability status ofinterfaces that are configuredfor IP.
Router# show ip cache flow Displays the NetFlow statisticssuch as:
v IP packet size distribution
v IP flow cache information
v Flow information; protocol,total flow, flows per second
Router# clear ip flow stats Clears the NetFlow statistics.
Chapter 6. Configuring Flow devices 127
An example Cisco device configurationCisco device configuration.configure terminalinterface serial 3/0/0ip route-cache flowexitip flow-export 127.1.0.0 0 version 5 peer-asexitclear ip flow statsRouter# show ip cache flow
The output is as shown:
IP packet size distribution (230151 total packets):1-32 64 96 128 160 192 224 256 288 320 352 384 416 448 480.999 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000512 544 576 1024 1536 2048 2560 3072 3584 4096 4608.000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000
Configuring flow on Juniper devicesProvides commands and examples to configure J-Flow on an SRX Series device.
Command modes
Command mode Description
Operational mode
When you log in to the router and type theCLI command, you are automatically inoperational mode:
user@host>
This mode displays the status of the device.In operational mode, you enter commandsto monitor and troubleshoot the Junos OS,devices, and network connectivity.
Configuration mode
user@host>configureuser@host#
To exit the mode, give the followingcommands:
user@host# commit and-quitcommit completeuser@host
To exit without commit:
user@host# exitExiting configuration modeuser@host>
A configuration for a device that is runningon Junos OS is stored as a hierarchy ofstatements. In configuration mode, you enterthese statements to define all properties ofthe Junos OS, including interfaces, generalrouting information, routing protocols, useraccess, and several system and hardwareproperties.
Active Flow monitoring
Flow monitoring versions 5, 8, and 9 support active flow monitoring. For activeflow monitoring, the monitoring station participates in the network as an activerouter. A router performs the following actions during active Flow monitoring:v Sampling
The router selects and analyzes only a portion of the traffic.v Sampling with templates
128 Network Performance Insight References
The router selects, analyzes, and arranges a portion of the traffic into templates.v Sampling per sampling instance
The router selects, analyzes, and arranges a portion of the traffic according to theconfiguration and binding of a sampling instance.
v Port mirroringThe router copies entire packets and sends the copies to another interface.
v Multiple port mirroringThe router sends multiple copies of monitored packets to multiple exportinterfaces with the next-hop-group statement at the (edit forwarding-options)hierarchy level.
v Discard accountingThe router accounts for selected traffic before it discards. Such traffic is notforwarded out of the router. Instead, the traffic is quarantined and deleted.
v Flow-tap processingThe router processes requests for active flow monitoring dynamically by usingthe Dynamic Tasking Control Protocol (DTCP).
Some of the commands for these actions are described here.Related information:
Flow Monitoring Feature Guide for Routing Devices
Active Flow Monitoring Overview
Configuring J-Flow versions 5 and 8Commands to configure J-Flow versions 5 and 8.
About this task
Commands Description
user@host# set interfaces ge-0/0/0 unit 0 familyinet sampling inputuser@host# set interfaces ge-0/0/0 unit 0 familyinet sampling output
Enables sampling on one or moreinterfaces and specify the direction.
Chapter 6. Configuring Flow devices 129
Commands Description
user@host# set forwarding-options samplinginput rate 100
Specifies the sampling rate.
CAUTION:Caution: Activation of flowcollection can have a significantimpact on the performance of theSRX Series device. The smallerthe sample rate, the bigger theimpact. It is recommended to notuse a sampling input rate of 1.
Where:
forwarding-optionsStarts the inline J-Flowconfiguration, so that thesampling and the J-Flowservice thread areimplemented in theforwarding engine.
samplingConfigures the J-Flowpacket sampling options.
input Enables sampling.
rate Specifies the ratio ofpackets to be sampled.
user@host# set forwarding-options sampling familyinet output flow-server 10.10.10.1 port 2056
Specifies the UDP port number ofthe host that is collecting cflowdpackets.
user@host# set forwarding-options sampling familyinet output flow-server 10.10.10.1 version 5
Specify the version format 5.
Related information:
SRX Getting Started - Configure J-Flow
Configuring J-Flow version 9Commands to configure J-Flow versions 9.
About this task
Commands Description
user@host# set services flow-monitoring version9template v4flow-active-timeout 30
user@host# set services flow-monitoring version9template v4 flow-inactive-timeout 30
user@host# set services flow-monitoring version9template v4 <ipv4-template>
Configures the J-Flow v9template.Note: Currently, the IPv4template is supported.
user@host# set forwarding-options samplinginput rate 100
user@host# set forwarding-options samplinginput run-length 0
Specifies the sampling rateand run length.
130 Network Performance Insight References
Commands Description
user@host# set forwarding-options samplingfamily inet output flow-server<IP_add> port 2222
user@host# set forwarding-options samplingfamily inet output flow-server <IP_address>version9 template <template_name>
Configures the externalflow collector and its portnumber.Note: The J-Flow v9template is associated withthe external flow collector.Up to eight flow collectorscan be simultaneouslyconfigured.
user@host# set forwarding-options samplinguser@host# set forwarding-options sampling inputuser@host# set forwarding-options sampling outputfamily inet output inline-jflow source-address<IP_address>
Configure the inline-jflow,so that the sampling andthe J-Flow service threadare implemented in theforwarding engine.
user@host# set interfaces ge-0/0/14 unit 0 familyinet sampling inputuser@host# set interfaces ge-1/0/0 unit 0 familyinet sampling output
user@host# set interfaces ge-0/0/14 unit 0 familyinet address <IP_address>/24
Configure the samplingfilter on an interface (orinterfaces) in the direction,on which the J-Flow serviceis required.
user@host# show interfaces descriptions Displays all the configuredinterfaces.
Related information:
Juniper Flow Monitoring
Configuring the sampling instanceYou can configure active sampling by using a sampling instance and associate thatsampling instance to a particular Packet Forwarding Engine. In addition, you candefine multiple sampling instances that are associated with multiple destinations(as many as the number of Packet Forwarding Engines in the chassis), withmultiple protocol families per each sampling instance destination.
About this taskset chassis fpc 0 sampling-instance s0set interfaces ge-0/1/0 unit 0 family inet sampling inputset interfaces ge-0/1/0 unit 0 family inet addressset interfaces ge-1/0/0 unit 0 family inet addressset interfaces sp-2/0/0 unit 0 family inetset forwarding-options sampling instance s0 input rate 1set forwarding-options sampling instance s0 input run-length 0set forwarding-options sampling instance s0 family inet output
flow-server 2.2.2.2 port 2055set forwarding-options sampling instance s0 family inet output
flow-server 2.2.2.2 version9 template v4;set forwarding-options sampling instance s0 family inet output
interface sp-2/0/0 source-address 1.1.1.1set routing-options static route 50.0.0.0/8 next-hop 20.0.0.2set services flow-monitoring version9 template v4 flow-active-timeout 30set services flow-monitoring version9 template v4 flow-inactive-timeout 30set services flow-monitoring version9 template v4 ipv4-template
Related information:
Example: Sampling Instance Configuration
Chapter 6. Configuring Flow devices 131
Configuring J-Flow version 9 for SRX-DataCenter devicesCommands to configure J-Flow versions 9 for SRX-DataCenter devices.
About this task
Commands Description
user@host# set services flow-monitoring version9template <template_name>
Configures the J-Flow v9 template
user@host# set samplng family inet outputflow server <flow_collector_ip_add>port <flow_collector_port>version9 template <template_name>
Configures external flow collector, inthis case, Network PerformanceInsight Collector.
user@host# set forwarding-options samplinginstance <instance1>input rate 100
user@host# set forwarding-options samplinginstance <instance1> inputrun-length 0
Specifies the sampling rate.Note: Currently, IPv4 template issupported.
user@host# set forwarding-options samplinginstance instance1 family inetoutput flow-server <Ip_address> port 2222
user@host# set forwarding-options samplinginstance instance1 family inetoutput flow-server <Ip_address> version9template <template_name>
Configures the external flowcollector and its port address.Note: The J-Flow v9 template isassociated with the external flowcollector. Up to eight flow collectorscan be simultaneously configured.
user@host# set forwarding-options samplinginstance instance1 family inet outputinline-jflow source-address <Ip_address>
Configures the inline-jflow, so thatthe sampling and the J-Flow servicethread are implemented in theforwarding engine.
user@host# set interfaces ge-0/0/14 unit 0family inet sampling inputuser@host# set interfaces ge-0/0/14 unit 0family inet address 2.2.2.1/24
Configures the sampling filter on aninterface (or interfaces) in thedirection, on which the J-Flowservice is required.
Related information:
SRX Getting Started - Configure J-Flow
Using the show commandsDescribes the possible show command options in configuration mode andOperational mode.
About this taskconfigure//To enter a configuration modeshow ?
132 Network Performance Insight References
<[Enter]> Execute this command> access Network access configuration> access-profile Access profile for this instance> accounting-options Accounting data configuration> applications Define applications by protocol characteristics+ apply-groups Groups from which to inherit configuration data> chassis Chassis configuration> class-of-service Class-of-service configuration> ethernet-switching-options Ethernet-switching configuration options> event-options Event processing configuration> firewall Define a firewall configuration> forwarding-options Configure options to control packet forwarding> groups Configuration groups> interfaces Interface configuration> multi-chassis> multicast-snooping-options Multicast snooping option configuration> policy-options Policy option configuration> protocols Routing protocol configuration> routing-instances Routing instance configuration> routing-options Protocol-independent routing option configuration> schedulers Security scheduler> security Security configuration> services Set services parameters> smtp Simple Mail Transfer Protocol service configuration> snmp Simple Network Management Protocol configuration> system System parameters> vlans VLAN configuration
| Pipe through a command
Exit//To exit the configuration modeShow// To run the show command options in User Excec mode
Chapter 6. Configuring Flow devices 133
accounting Show accounting profiles and recordsarp Show system Address Resolution Protocol table entriesas-path Show table of known autonomous system pathsauthentication-whitelist Show 802.1X White List MAC addressesbfd Show Bidirectional Forwarding Detection informationbgp Show Border Gateway Protocol informationchassis Show chassis informationclass-of-service Show class-of-service (CoS) informationcli Show command-line interface settingsconfiguration Show current configurationconnections Show circuit cross-connect connectionsdatabase-replication Show database replication informationdhcp Show Dynamic Host Configuration Protocol informationdhcpv6 Show Dynamic Host Configuration Protocol v6 informationdialer Show dialer informationdot1x Show 802.1X informationdvmrp Show Distance Vector Multicast Routing Protocol informationdynamic-tunnels Show dynamic tunnel information informationesis Show end system-to-intermediate system informationethernet-switching Show Ethernet-switching informationevent-options Show event-options informationfirewall Show firewall informationforwarding-options Show forwarding-options informationgvrp Show Generic VLAN Registration Protocol informationhelper Show port-forwarding helper informationhfrr Show information related to Host (Direct route) Fast reroutehost Show hostname information from domain name servericcp Show Inter Chassis Control Protocol informationigmp Show Internet Group Management Protocol informationigmp-snooping Show IGMP snooping informationingress-replication Show Ingress-Replication tunnel informationinterfaces Show interface informationipv6 Show IP version 6 informationisdn Show Integrated Services Digital Network informationisis Show Intermediate System-to-Intermediate System informationl2circuit Show Layer 2 circuit informationl2vpn Show Layer 2 VPN informationlacp Show Link Aggregation Control Protocol informationldp Show Label Distribution Protocol informationlldp Show Link Layer Discovery Protocol informationlog Show contents of log filemld Show multicast listener discovery informationmld-snooping Show MLD snooping informationmpls Show mpls informationmsdp Show Multicast Source Discovery Protocol informationmulticast Show multicast informationmvpn Show Multicast Virtual Private Network (MVPN) informationnetwork-access Show network-access related informationntp Show Network Time Protocol informationoam Show OAM-related informationospf Show Open Shortest Path First informationospf3 Show Open Shortest Path First version 3 informationpfe Show Packet Forwarding Engine informationpgm Show Pragmatic Generalized Multicast informationpim Show Protocol Independent Multicast informationpolicer Show interface policer counters and informationpolicy Show policy informationppp Show PPP process informationpppoe Show PPP over Ethernet informationr2cp Show Radio-to-Router Protocol informationrip Show Routing Information Protocol informationripng Show Routing Information Protocol for IPv6 informationroute Show routing table informationrsvp Show Resource Reservation Protocol informationsap Show Session Announcement Protocol informationschedulers Show the information on one or more schedulerssecurity Show security informationservices Show servicessmtp Show Simple Mail Transfer Protocol informationsnmp Show Simple Network Management Protocol informationspanning-tree Show Spanning Tree Protocol informationsystem Show system informationtask Show routing protocol per-task informationted Show Traffic Engineering Database informationtgm Show telephony gateway module informationversion Show software process revision levelsvlans Show VLAN informationvpls Show VPLS informationvrrp Show Virtual Router Redundancy Protocol informationwan-acceleration Show WAN acceleration module information
134 Network Performance Insight References
Verifying the configuration with show commandsTo verify that your configuration is correct, use these commands on the monitoringstation that is configured for active flow monitoring.
About this taskshow servicesshow services flow-monitoringshow services flow-monitoring version9 template <template_name>show services accounting errorsshow services accounting (flow | flow-detail)show services accounting memoryshow services accounting packet-size-distributionshow services accounting statusshow services accounting usageshow services accounting aggregation template template-namename (detail | extensive | terse)
Most active flow monitoring operational mode commands contain equivalentoutput information to the following passive flow monitoring commands:show services accounting errors = show passive-monitoring errorshow services accounting flow = show passive-monitoring flowshow services accounting memory = show passive-monitoring memoryshow services accounting status = show passive-monitoring statusshow services accounting usage = show passive-monitoring usage
The active flow monitoring commands can be used with most active flowmonitoring applications, including sampling, discard accounting, port mirroring,and multiple port mirroring. The following command shows the output of theshow commands that are used with the configuration example:user@router> show services accounting errors
Service Accounting interface: sp-2/0/0, Local interface index: 542Service name: (default sampling)Error information
Packets dropped (no memory): 0, Packets dropped (not IP): 0Packets dropped (not IPv4): 0, Packets dropped (header too small): 0Memory allocation failures: 0, Memory free failures: 0Memory free list failures: 0Memory overload: No, PPS overload: No, BPS overload: Yes
user@router> show services accounting flow-detail limit 10
Service Accounting interface: sp-2/0/0, Local interface index: 468Service name: (default sampling)Protocol Source Source Destination Destination Packet Byte
Address Port Address Port count countudp(17) 10.1.1.2 53 10.0.0.1 53 4329 3386035ip(0) 10.1.1.2 0 10.0.0.2 0 4785 3719654ip(0) 10.1.1.2 0 10.0.1.2 0 4530 3518769udp(17) 10.1.1.2 0 10.0.7.1 0 5011 3916767tcp(6) 10.1.1.2 20 10.3.0.1 20 1 1494tcp(6) 10.1.1.2 20 10.168.80.1 20 1 677tcp(6) 10.1.1.2 20 10.69.192.1 20 1 446tcp(6) 10.1.1.2 20 10.239.240.1 20 1 1426tcp(6) 10.1.1.2 20 10.126.160.1 20 1 889tcp(6) 10.1.1.2 20 10.71.224.1 20 1 1046
user@router> show services accounting memory
Chapter 6. Configuring Flow devices 135
Service Accounting interface: sp-2/0/0, Local interface index: 468Service name: (default sampling)Memory utilization
Allocation count: 437340, Free count: 430681, Maximum allocated: 6782Allocations per second: 3366, Frees per second: 6412Total memory used (in bytes): 133416928, Total memory free (in bytes): 133961744
user@router> show services accounting packet-size-distribution
Service Accounting interface: sp-2/0/0, Local interface index: 468Service name: (default sampling)Range start Range end Number of packets Percentage packets
64 96 1705156 100
user@router> show services accounting status
Service Accounting interface: sp-2/0/0, Local interface index: 468Service name: (default sampling)Interface state: MonitoringGroup index: 0Export interval: 60 secs, Export format: cflowd v5Protocol: IPv4, Engine type: 55, Engine ID: 5Route record count: 13, IFL to SNMP index count: 30, AS count: 1Time set: Yes, Configuration set: YesRoute record set: Yes, IFL SNMP map set: Yes
user@router> show services accounting usage
Service Accounting interface: sp-2/0/0, Local interface index: 468Service name: (default sampling)CPU utilizationUptime: 4790345 milliseconds, Interrupt time: 1668537848 microsecondsLoad (5 second): 71%, Load (1 minute): 63%
Related information:
Verifying Your Work
Viewing device configurationAn example configuration for the J-Flow v9 template ipv4-test, flow collector172.19.101.85 (port 2222) with sampling rate 1:100 and run length as 0.
For example, to view the configuration for the following set commands:set services flow-monitoring version9 template ipv4-test ipv4-templateset forwarding-options sampling input rate 1set forwarding-options sampling input run-length 0set forwarding-options sampling family inet output flow-server 172.19.101.85 port2222set forwarding-options sampling family inet output flow-server 172.19.101.85version9 template ipv4-testset forwarding-options sampling family inet output inline-jflow source-address172.19.101.132set interfaces ge-0/0/14 unit 0 family inet sampling inputset interfaces ge-0/0/14 unit 0 family inet address 23.23.23.1/24
Give this command to view the details:show configuration
136 Network Performance Insight References
Configuring NetStream traffic on Huawei devicesHuawei devices support NetStream flow, which is a supported flow type inNetwork Performance Insight.Related information:
NetStream (Integrated) Technology White Paper
Configuring NetStream exportHuawei NetStream works much like Cisco NetFlow. The NetStream processgathers detailed data about flows and stores them to a cache table. NetStream thenprocesses the flow data from the cache table and sends it to Network PerformanceInsight for monitoring.
About this task
There are export options for flow sampling, aggregation, and flow record contentdepending on how and what you are monitoring and how you need to export andreport.
Commands Description
[RouterA] ip NetStream export host <hostname>|<ip_address> 9996
Enables NetStream onHuawei devices
ip NetStream export source interface <interface_name> Exports the NetStreamdata to a specified IPaddress.
[RouterA] ip NetStream sampler inbound 100
[RouterA] ip NetStream sampler outbound 100
Configures globalsampling.
[RouterA] interface gigabitethernet 1/0/0
[RouterA-GigabitEthernet1/0/0] ip address<IP_address1> <IP_address2>
Sets up an interface.
[RouterA-GigabitEthernet1/0/0] ip NetStream inbound
[RouterA-GigabitEthernet1/0/0] ip NetStream outbound
Enables NetStreamstatistics on the inboundand outbound interfaces
Chapter 6. Configuring Flow devices 137
138 Network Performance Insight References
Notices
This information was developed for products and services offered in the US. Thismaterial might be available from IBM in other languages. However, you may berequired to own a copy of the product or product version in that language in orderto access it.
IBM may not offer the products, services, or features discussed in this document inother countries. Consult your local IBM representative for information on theproducts and services currently available in your area. Any reference to an IBMproduct, program, or service is not intended to state or imply that only that IBMproduct, program, or service may be used. Any functionally equivalent product,program, or service that does not infringe any IBM intellectual property right maybe used instead. However, it is the user's responsibility to evaluate and verify theoperation of any non-IBM product, program, or service.
IBM may have patents or pending patent applications covering subject matterdescribed in this document. The furnishing of this document does not grant youany license to these patents. You can send license inquiries, in writing, to:
IBM Director of LicensingIBM CorporationNorth Castle Drive, MD-NC119Armonk, NY 10504-1785US
For license inquiries regarding double-byte character set (DBCS) information,contact the IBM Intellectual Property Department in your country or sendinquiries, in writing, to:
Intellectual Property LicensingLegal and Intellectual Property LawIBM Japan Ltd.19-21, Nihonbashi-Hakozakicho, Chuo-kuTokyo 103-8510, Japan
INTERNATIONAL BUSINESS MACHINES CORPORATION PROVIDES THISPUBLICATION "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHEREXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIEDWARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY OR FITNESSFOR A PARTICULAR PURPOSE. Some jurisdictions do not allow disclaimer ofexpress or implied warranties in certain transactions, therefore, this statement maynot apply to you.
This information could include technical inaccuracies or typographical errors.Changes are periodically made to the information herein; these changes will beincorporated in new editions of the publication. IBM may make improvementsand/or changes in the product(s) and/or the program(s) described in thispublication at any time without notice.
Any references in this information to non-IBM websites are provided forconvenience only and do not in any manner serve as an endorsement of those
© Copyright IBM Corp. 2015, 2018 139
websites. The materials at those websites are not part of the materials for this IBMproduct and use of those websites is at your own risk.
IBM may use or distribute any of the information you provide in any way itbelieves appropriate without incurring any obligation to you.
Licensees of this program who wish to have information about it for the purposeof enabling: (i) the exchange of information between independently createdprograms and other programs (including this one) and (ii) the mutual use of theinformation which has been exchanged, should contact:
IBM Director of LicensingIBM CorporationNorth Castle Drive, MD-NC119Armonk, NY 10504-1785US
Such information may be available, subject to appropriate terms and conditions,including in some cases, payment of a fee.
The licensed program described in this document and all licensed materialavailable for it are provided by IBM under terms of the IBM Customer Agreement,IBM International Program License Agreement or any equivalent agreementbetween us.
The performance data discussed herein is presented as derived under specificoperating conditions. Actual results may vary.
The client examples cited are presented for illustrative purposes only. Actualperformance results may vary depending on specific configurations and operatingconditions.
Information concerning non-IBM products was obtained from the suppliers ofthose products, their published announcements or other publicly available sources.IBM has not tested those products and cannot confirm the accuracy ofperformance, compatibility or any other claims related to non-IBM products.Questions on the capabilities of non-IBM products should be addressed to thesuppliers of those products.
Statements regarding IBM's future direction or intent are subject to change orwithdrawal without notice, and represent goals and objectives only.
All IBM prices shown are IBM's suggested retail prices, are current and are subjectto change without notice. Dealer prices may vary.
This information is for planning purposes only. The information herein is subject tochange before the products described become available.
This information contains examples of data and reports used in daily businessoperations. To illustrate them as completely as possible, the examples include thenames of individuals, companies, brands, and products. All of these names arefictitious and any similarity to actual people or business enterprises is entirelycoincidental.
COPYRIGHT LICENSE:
140 Network Performance Insight References
This information contains sample application programs in source language, whichillustrate programming techniques on various operating platforms. You may copy,modify, and distribute these sample programs in any form without payment toIBM, for the purposes of developing, using, marketing or distributing applicationprograms conforming to the application programming interface for the operatingplatform for which the sample programs are written. These examples have notbeen thoroughly tested under all conditions. IBM, therefore, cannot guarantee orimply reliability, serviceability, or function of these programs. The sampleprograms are provided "AS IS", without warranty of any kind. IBM shall not beliable for any damages arising out of your use of the sample programs.
Each copy or any portion of these sample programs or any derivative work mustinclude a copyright notice as follows:
© (your company name) (year).Portions of this code are derived from IBM Corp. Sample Programs.© Copyright IBM Corp. _enter the year or years_.
TrademarksIBM, the IBM logo, and ibm.com are trademarks or registered trademarks ofInternational Business Machines Corp., registered in many jurisdictions worldwide.Other product and service names might be trademarks of IBM or other companies.A current list of IBM trademarks is available on the web at "Copyright andtrademark information" at www.ibm.com/legal/copytrade.shtml.
Adobe, Acrobat, PostScript and all Adobe-based trademarks are either registeredtrademarks or trademarks of Adobe Systems Incorporated in the United States,other countries, or both.
IT Infrastructure Library is a registered trademark of the Central Computer andTelecommunications Agency which is now part of the Office of GovernmentCommerce.
Intel, Intel logo, Intel Inside, Intel Inside logo, Intel Centrino, Intel Centrino logo,Celeron, Intel Xeon, Intel SpeedStep, Itanium, and Pentium are trademarks orregistered trademarks of Intel Corporation or its subsidiaries in the United Statesand other countries.
Linux is a registered trademark of Linus Torvalds in the United States, othercountries, or both
Microsoft and Windows are trademarks of Microsoft Corporation in the UnitedStates, other countries, or both.
ITIL is a registered trademark, and a registered community trademark of TheMinister for the Cabinet Office, and is registered in the U.S. Patent and TrademarkOffice.
UNIX is a registered trademark of The Open Group in the United States and othercountries.
Java and all Java-based trademarks and logosare trademarks or registered trademarks ofOracle and/or its affiliates.
Notices 141
Cell Broadband Engine is a trademark of Sony Computer Entertainment, Inc. in theUnited States, other countries, or both and is used under license therefrom.
Linear Tape-Open, LTO, the LTO Logo, Ultrium, and the Ultrium logo aretrademarks of HP, IBM Corp. and Quantum in the U.S. and other countries.
Terms and conditions for product documentationPermissions for the use of these publications are granted subject to the followingterms and conditions.
Applicability
These terms and conditions are in addition to any terms of use for the IBMwebsite.
Personal use
You may reproduce these publications for your personal, noncommercial useprovided that all proprietary notices are preserved. You may not distribute, displayor make derivative work of these publications, or any portion thereof, without theexpress consent of IBM.
Commercial use
You may reproduce, distribute and display these publications solely within yourenterprise provided that all proprietary notices are preserved. You may not makederivative works of these publications, or reproduce, distribute or display thesepublications or any portion thereof outside your enterprise, without the expressconsent of IBM.
Rights
Except as expressly granted in this permission, no other permissions, licenses orrights are granted, either express or implied, to the publications or anyinformation, data, software or other intellectual property contained therein.
IBM reserves the right to withdraw the permissions granted herein whenever, in itsdiscretion, the use of the publications is detrimental to its interest or, asdetermined by IBM, the above instructions are not being properly followed.
You may not download, export or re-export this information except in fullcompliance with all applicable laws and regulations, including all United Statesexport laws and regulations.
IBM MAKES NO GUARANTEE ABOUT THE CONTENT OF THESEPUBLICATIONS. THE PUBLICATIONS ARE PROVIDED "AS-IS" AND WITHOUTWARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDINGBUT NOT LIMITED TO IMPLIED WARRANTIES OF MERCHANTABILITY,NON-INFRINGEMENT, AND FITNESS FOR A PARTICULAR PURPOSE.
142 Network Performance Insight References
Notices 143
IBM®
Printed in USA