Map Flow Objects

The Object Mapping page enables you to map the indicators on the objects that plugins poll to a flow interface. This enables you to display a FlowFalcon report of the flow data that is related to the poll data from an indicator that appears in an Instant Graph. When multiple objects rely on flow data from a single interface you can map multiple objects to a single flow interface, even if the objects are on different devices. Objects for which you define a mapping display a NetFlow button when you create an Instant Graph or enable the ability to chain from a report attachment that contains the object to a FlowFalcon attachment. The object mapping includes the designation of the FlowFalcon view and the definition of the filters for the FlowFalcon Reports page to use to display the flow information you specify. When you click the NetFlow button on an instant graph, the FlowFalcon Reports page appears with the view, settings, and filters you define from the Object Mapping page.

To access the Object Mapping page from the navigation bar, click the Administration menu, select Flow Configuration, and then select Object Mapping.

images/download/attachments/163973135/mapobjects-version-1-modificationdate-1693243141550-api-v2.png

When you enable the SNMP plugin for a device and you enable the device to send flow data to SevOne NMS, most SNMP objects are automatically mapped to their corresponding flow interface. For other plugin objects and SNMP objects such as QoS, the Object Mapping page enables you to map the indicator to an interface and to define the FlowFalcon report parameters that are applicable to the data.

As of SevOne NMS 6.6.0, flow devices and interfaces can now be automatically associated with the SNMP-managed device / object / indicator that uses enterprise-specific MIB and custom IP. Manual associations are no longer required if Allow Mapping field is enabled.

An object metadata attribute, NetflowInterfaceIndex, is applied to objects rather than devices and will be used for determining the interfaceIndex of a SevOne NMS object when establishing the object mapping. When an object has this metadata attribute set, the default SNMP index of the object is overridden by the value of the metadata attribute. I f the value of the metadata attribute NetflowInterfaceName is also set, then it will be used to name the interface and will override the name of the object. i.e., the default Interface of the object will get overridden by the object name.

The objects must have indicators for the object types that have the field Allow Netflow Mapping enabled. Please refer to the section Object Types > subsections SNMP Atomic Indicator Types and Synthetic Indicator Types or they must be interfaces, which is the default functionality prior to SevOne NMS 6.6.0.

For details, on how to add a metadata namespace and then, add a metadata attribute to it, please refer to Metadata Schema.

Example

To display the flows for QoS Queues, create an object mapping that uses a FlowFalcon view that contains DSCP and has an appropriate filter to display a FlowFalcon report of the traffic that moves across the queue.

Users have access to view devices to which user has permissions. To give a user permissions to view a flow device, the user should be granted Device View access to a plugin device that is mapped to this flow device via object mapping relation.

Map List

The list displays the mapping relationship between an indicator and its corresponding flow interface.

Device - Displays the name of the device that contains the indicator the plugin polls.
Plugin - Displays the name of the plugin that polls the object that contains the indicator.
Object - Displays the name of the object that contains the indicator you map to a flow interface.
Indicator - Displays the name of the indicator you map to a flow interface.
Flow Device - Displays the name of the device that contains the interface that sends flow data to SevOne NMS.
Flow Interface - Displays the name of the flow interface to which you map the indicator.
Flow Direction - Displays the mapping direction.
View - Displays the name of the FlowFalcon view the FlowFalcon Reports page uses for the FlowFalcon report that displays the flow information for the indicator/interface.
Filter - Displays the name of the filter you define to apply to the FlowFalcon report.
Validated - Displays all valid and invalid NetFlow entries. Valid entries are displayed as Yes and invalid entries are displayed as No in this column. When you hover over a row in this column with an invalid entry, it provides a tooltip with the exact validation failure message.

Manage Mappings

The Add/Edit Object Mapping pop-up contains four sections. The SevOne Device section enables you to select the indicator to which to map the flow interface. The Flow Device section enables you to select the flow interface to which to map the indicator. The View section enables you to select the FlowFalcon view to use for the FlowFalcon report. The Filter section enables you to define the filter to apply to the FlowFalcon report. Each filter is composed of rules and if a rule is not applicable for the FlowFalcon view, the filter ignores the rule. This enables you to create filters that are applicable for multiple FlowFalcon views.

Click Add Object Mapping or click to display the Add/Edit Object Mapping pop-up.
SevOne Device
1. lick the Device drop-down and select the device that contains the indicator.
2. Click the Object drop-down and select the object that contains the indicator to map.
3. Click the Indicator drop-down and select the indicator.
Flow Device
1. Click the Device drop-down and select the flow device that contains the interface.
2. Click the Interface drop-down and select the interface to which to map the indicator.
3. Click the Direction drop-down and select the direction of the interface mapping.
FlowFalcon View
1. Click the View drop-down and select the view for the FlowFalcon Reports page to display for the indicator's interface data.
Select the Filter check box to add a filter to the FlowFalcon report that limits the results in the FlowFalcon report.
1. Click the Filter drop-down and select a filter. To create a new filter, select New Filter.
2. In the Filter Name field, enter the filter name.
3. Click Add Filter Rule or click to display a new line in the list or to make the rule editable.
  - Click the Field drop-down and select the field on which to apply the rule. Fields from the view you select appear first in the list followed by every known field from flow data. The FlowFalcon View Editor displays field details.
  - Click the Boolean drop-down and select Is to define the rule with an Is Boolean operator or select Is Not to define the rule with an Is Not Boolean operator.
    
    The filter Boolean expression works such that for each unique field, SevOne NMS creates a Boolean expression that consists of the negative rules and the positive rules. The negative rules are AND'd to form a sub-expression and the positive rules are OR'd to form a sub-expression. These sub-expressions are then AND'd to form the final expression for each unique field. Then, each unique field's composite expression is AND'd to other field expressions.
  - Click the Operator drop-down and select a comparison operator. Most operators are self-evident.
    
    Depending on the field you selected for Field, the Operator options may include Mask and Subnet (in addition to Equal To, Greater Than, Less Than, and Between). Select Mask to report on flow data that needs to match in the manner of IP address subnet masking. Select Subnet to report on flow data that needs to be from the subnet you select from the Network Segment drop-down. The Network Segment drop-down becomes available when you select Subnet as the operator. For information about defining network segments, please see the section Network Segment Manager.
  - In the First Value field enter the first value on which to filter data.
  - In the Second Value field, enter the second value in a value range, when applicable.
  - Click Update to save the rule.
4. Repeat these steps to add additional rules to the filter.
5. To delete a filter, click the Filter drop-down and select the filter to delete. You will get the following message. Click Yes to continue with the deletion; every object mapping associated with it will be without this filter, all associated policies and thresholds will be deleted, and any related alerts will be acknowledged. Click No to cancel.
Click Save to save the object mapping changes.

Table of Contents (Start)

Map Flow Objects

Map List

Manage Mappings