FlowFalcon Reports

Resources

The Resources section enables you to select the interfaces, device groups/device types, or object groups from which to present a FlowFalcon report. You cannot select a redundant resource.

1. Click the Resource Type drop-down.

   • Select Interfaces to create a report for flow data from the interfaces you allow on the Flow Interface Manager.

     1. Click the Device drop-down and select a device. Select All Devices to define the report to contain all devices.

     2. Click the Interface drop-down and select an interface. Select All Interfaces to define the report to contain all interfaces on the device you select.

     3. Click the Direction drop-down and select whether to define the report to display the Incoming, Outgoing, or All Directions traffic.

   • Select Device Groups, then click the Device Group drop-down and select a device group/device type. Select All Device Groups to define the report to contain all device groups/device types.

   • Select Object Groups, then click the Object Group drop-down and select an object group.

2. Click Add Resource to add the device, interface, and direction to the Current Resources list.

3. Repeat to add additional resources.

Report Settings

The Report Settings section enables you to select the view and to define the report settings for the report. FlowFalcon views enable you to define the flow template fields to display in the report. SevOne NMS provides starter set FlowFalcon views to enable you to create common FlowFalcon reports

1. Click the Aggregated Data drop-down.

   • Select Yes to populate the View drop-down list with views that use aggregated flow data which stores the most relevant flow data for faster report creation.

     When you create a TopN flow report (e.g., Top Talkers) based on aggregated data, the report will not be entirely precise. You can increase the value for the Aggregation TopN setting from Cluster Manager > Cluster Settings tab > FlowFalcon subtab for greater precision. However, any value greater than 100 will increase the system load, which may eventually lead to data loss.

   • Select No to populate the View drop-down list with views that use raw flow data to allow for more specificity in the result set at the trade off of longer report execution times and less historical data availability.

2. Click the View drop-down and select a view. The list of views is dependent on the selection you make from the Aggregated Data drop-down. Please refer to topic FlowFalcon Views to view the list of FlowFalcon views. If you do not see an applicable view, the View field caption provides access to the FlowFalcon View Editor where you can create custom views.

3. Click the Time Span drop-down.
   

   • Select Today to display data from 12:00am today until now.

   • Select Past <X> Hours, Days, Weeks to display data from <X> hours, days, or weeks ago until now.

   • Select Yesterday to display data from 12:00am yesterday until 12:00am today.

   • Select This Week, Month, Quarter to display data from 12:00am on the first day of the week, month, or quarter until now.

   • Select Last Week, Month, Quarter to display data from 12:00am on the first day of the last completed week, month, or quarter to 11:59pm on the last day of the last completed week, month, or quarter.

   • Select Custom to display the Choose a Time Range pop-up that enables you to define a custom time span.

4. Click the Time Zone drop-down and select a time zone.

5. Click the Split drop-down.

   • Select Nothing to combine all results from the same direction across the same interface to allow for greater detail in the result set.

   • Select Interfaces to separate flow data into individual interfaces.

   • Select Groups to separate flow data by device group/device type or object group depending on the resource you select. This option appears when you select Device Groups or Object Groups in the Resource section.

6. Click the Network Segment drop-down and select a network segment. This enables you to resolve IP addresses into segments and to roll up results from the same segment into a single result. The Network Segment field caption link provides access to the Network Segment Manager where you manage network segments.

7. Click the Graph Other drop-down.

   • Select Yes to display flow data for the top <n> results individually in the pie chart and the stacked line graph plus a Remaining Traffic graph item that groups the flow for the remaining flow sources that meet your filter criteria. You define <n> results in the next step.

   • Select No to display only the top <n> results in the pie chart and the stacked line graph. Remaining Traffic continues to display in the table.

8. In the Results Limit field, enter the number of individual results to display in the table. The display includes the first 200 results to optimize browser performance. Export the report to a .csv format or to a .pdf format to view the full result set of more than 200 results. Filters enable you to narrow the scope of the request (see the Filters section below). You can also modify the Current Resources list to limit the number of resources in the report (see the Resources section above).

Advanced Report Settings

FlowFalcon reports display a table of flow data that can include a variety of information that describe the flows. The Advanced Report Settings section enables you to select the data columns to include in the FlowFalcon report table.

1. Click Advanced Report Settings to display the advanced report settings controls.

2. In the Data Columns field, select the check box for each data column to include in the report table. You must select the check box for at least one data column. All columns are described at the end of this chapter.

3. Click the Sort Column drop-down and select the data column on which to sort the table in the FlowFalcon report. This drop-down list displays the data columns you select in the previous step. The data column you select in this step determines the data to display in the pie chart and the stacked line graph in the FlowFalcon report.

4. Click the Sort Order drop-down and select to sort data in either Ascending or Descending order.

Resolution Settings

The Resolution Settings section enables you to define domain name resolution settings.

1. Click Resolution Settings to display the resolution settings controls.

2. Click the Application ID drop-down.

   • Select Display Octet Array to display the application id as a hexadecimal number.

   • Select Display Name to display the application name.

   • Select Display Both to display both the application id and application name.

3. Click the AS drop-down.

   • Select Display Number to display AS port numbers.

   • Select Display Name to display AS port names.

   • Select Display Both to display both numbers and resolved names.

4. Click the Country drop-down.

   • Select Display Code to display the country code.

   • Select Display Name to display the country name.

   • Select Display Both to display both, the country code and country name .

     If the country cannot be determined from the flow, the report will return ?? in the appropriate country columns.

5. Click the DNS drop-down.

   • Select Display IP to display raw IP addresses.

   • Select Display DNS to display resolved domain names when possible.

   • Select Display Both to display both IP addresses and resolved domain names.

6. Click the DSCP drop-down.

   • Select Display Number to display DSCP port numbers.

   • Select Display Name to display DSCP port names.

   • Select Display Both to display both numbers and resolved names.

7. Click the Port drop-down.

   • Select Display Number to display raw port numbers.

   • Select Display Name to display resolved port names.

   • Select Display Both to display both numbers and resolved names.

8. Click the Protocol drop-down.

   • Select Display Number to display raw protocol numbers.

   • Select Display Name to display resolved protocol names.

   • Select Display Both to display both numbers and resolved names.

9. Click the Service Profile drop-down.

   • Select Display Number to display service profile ids.

   • Select Display Name to display service profile names.

   • Select Display Both to display both ids and resolved names.

     FlowFalcon Resolution can also be set from Reports > Create Report > select source, FlowFalcon > in the left-navigation bar, select Settings > FlowFalcon Resolution tab > field Display Service Profile.

10. Click the Service Category drop-down.
    

    • Select Display Number to display service category ids.

    • Select Display Name to display service category names.

    • Select Display Both to display both ids and resolved names.

      FlowFalcon Resolution can also be set from Reports > Create Report > select source, FlowFalcon > in the left-navigation bar, select Settings > FlowFalcon Resolution tab > field Display Service Category.

Display Settings

The Display Settings section enables you to define display settings.

1. Click Display Settings to display the display settings controls.

2. Click the Granularity drop-down and select the interval between data points in the results. SevOne NMS is optimized to receive flows every one minute. If you configure the router to send flows at a different interval, this setting enables you to view the report at the granularity that matches the router flow timeout setting. A router flow cache setting other than one minute is not recommended.
   

   • Select Auto to use the highest applicable granularity for the best display and fastest load time based on the time span you select.

   • Select a predefined interval.

   • Select Custom to enter a custom granularity. There is no limit to this value, but if the granularity is too small for the time span, SevOne NMS adjusts the granularity.

3. Click the Preferred Units drop-down and select Bits for network oriented data or select Bytes for server oriented data.

4. Click the Display as drop-down and select Total to display the results as total volume or select Average Rate to display the results as rate or select Both to display the results as total volume and rate.
   

Filters

The Filters section enables you to limit the results that appear in the report. Each filter contains one or more rules to specifically address what is to be included in the report. Each filter rule applies to a specific flow field. Filter rules for a field that is not in the view are ignored. This enables you to define filters independently from views.

When you apply a filter to a FlowFalcon report that uses aggregated data, the Other Traffic and Total Traffic numbers may appear inaccurate due to how the data is aggregated and stored in pre-calculated buckets. If you do not receive the expected number of results after you apply a filter to an aggregated view, increase the number of aggregated results to store for each write interval on the Cluster Manager > Cluster Settings tab > FlowFalcon subtab > field Aggregation TopN.

To delete a filter, click the Filter drop-down and select the filter to delete. The rules list displays the rules for the filter you select. Click Delete Filter to delete the filter. You will get the following warning message. Click Yes to continue with the deletion; it will delete all thresholds associated with this filter and all alerts for deleted thresholds will be acknowledged. Click No to cancel.

Get Report Results

You can get a FlowFalcon report using the default FlowFalcon Reports page settings in two clicks. To get specific FlowFalcon report results, you can either perform the steps in the Define FlowFalcon Reports section before you run the report or you can run the report and then adjust settings to get specific information.

1. At the top of the FlowFalcon Reports page, the Resources section displays All Devices, All Interfaces, and All Directions. Click Add Resource to add all devices, all interfaces, and all directions to the Current Resources list.

2. Below the Filters section on the FlowFalcon Reports page, click Get Results.

   If you create or update device/object groups and then, run the FlowFalcon Report, it may take a few minutes for the report to be returned with the expected results. For the purposes of FlowFalcon reporting, device/object groups are refreshed once every 10 minutes, resulting in the delay.

Detach FlowFalcon Reports

The following icons appear in the title bar on FlowFalcon Reports page to enable you to export a FlowFalcon report.

- Click to export all granular data points in the graph to a .csv format.

- Click to export the data summary data from the table to a .csv format.

- Click to export the report to a .pdf format.

- Click to add the FlowFalcon report as an attachment in a report on a new browser tab. You can modify reports to add other attachments and you can save reports to the Report Manager. Report workflows enable you to designate reports to be your favorite reports and to define one report to appear as your custom dashboard.

Navigate FlowFalcon Reports

FlowFalcon reports enable you to adjust the settings for the current graph then Get Results again. You can select a related view to Graph Updated View to drill down or fan out to get related information without having to revise the report settings. You can select specific rows in the table and Graph Selected Rows.

You can perform these steps in any sequence for any FlowFalcon report to display specific data.

• Click the Refresh Rate drop-down and select a refresh rate to update the report data at the frequency you select. You should not set the refresh rate to less than the write interval. The default write interval writes flow data to the disk every 60 seconds. The Cluster Manager > Cluster Settings tab enables you to adjust the write interval.

• Click the View drop-down below the Get Results button. The following views appear when applicable.

  • Drill Down: Views that contain the exact same fields in the same sequence as the view you used to create the report plus additional fields. This enables you to drill down to display additional information in the subsequent report.

  • Fan Out: Views that share at least one field with the view you used to create the report. This enables you to fan out to display related information in the subsequent report.

• In the table in the report, click to manage the selection of the items in the table.

• Click Get Results to create a new report after you change the settings in the areas above the Get Results button.

  • Make changes in the Interfaces, Report Settings, Advanced Report Settings, Resolution Settings, Display Settings, and Filters sections.

  • Click Get Results.

• Click Graph Updated View to create a new FlowFalcon report with the drill down or fan out view and the same settings you define previously from the Interfaces, Advanced Report Settings, Resolution Settings, and Display Settings sections.

• Click Graph Selected Rows to use all of the settings from above to create a new graph for the data in the rows you select in the report table.

  • In the FlowFalcon report table, click and select Select None to clear the check boxes for all rows in the table.

  • Select the check box for one row in the table.

  • Click Graph Selected Rows.

• Click within the FlowFalcon report table to display a line graph for that specific data item.
  

  • Click on an item in the Bandwidth column.

  • A line graph of the bandwidth for the source appears.

Remaining Traffic, Total Traffic, and FlowFalcon Flow Calculation

The bottom rows of the FlowFalcon report table contain rows for Remaining Traffic and Total Traffic.

• The Remaining Traffic row displays the total of all interfaces that are not part of the top <n> results (where <n> is the number you enter in the Results Limit field in the Report Settings section above). If there are fewer results than the number you enter in the Report Settings section, the Remaining Traffic row does not appear.

• The Total Traffic row displays the total of all interfaces in the report, regardless of whether the source appear listed individually in the list or not.

The Graph Other setting in the Report Settings section enables you to include the remaining traffic and total traffic in the pie chart and stacked line graph. Click the Graph Other drop-down and select Yes to display a gray slice in the pie graph and a gray line in the stacked line chart that represents the remaining traffic.

FlowFalcon reports depict the total rate of flows for each device/interface/direction after duplicating flows that lack directional information. NetFlow v5 only exports information about the incoming interface so SevOne NMS duplicates the flow statistics for v5 NetFlow to enable you to run reports for outgoing flows on devices that use v5 NetFlow. If your network only uses v5 NetFlow, the FlowFalcon report flow rate should be double the actual rate of flows that arrive at the collector. Cluster Manager > Cluster Settings enable you to simulate missing egress and missing ingress flows for other flow technologies. The flow rate in FlowFalcon reports is different from the flow rate that displays on the Flow Interface Manager that uses a different calculation for flow data.