Set up network flow data monitoring

• A New Relic account. Don't have one? Sign up for free! No credit card required.
• A New Relic account ID.
• A New Relic license key.

• Docker installed in a Linux host.
• SSH access to the Docker host, with the ability to launch new containers.

• Configured network devices to send flow data to the host running the ktranslate docker container. Here's how to configure network flow data collection in some devices:
  • NetFlow data
    • Cisco - IOS
    • Cisco - Meraki
    • Cisco - NX-OS
    • Fortinet Fortigate
    • Palo Alto - PAN-OS
  • sFlow data
    • F5 - BIG-IP
  • jFlow data
    • Juniper - Junos

NPM flow monitoring supports the four primary types of network flow data and their derivatives. When running the ktranslate container, you will specify which major type you want to monitor using the -nf.source option.

If you prefer to do the setup manually, proceed with the following steps.

1. In your local machine, from a Linux host with Docker installed, download the ktranslate image by running one of the following:

   • Docker Hub
     bash

     Copy

     $
     docker pull kentik/ktranslate:v2

   • Quay.io
     bash

     Copy

     $
     docker pull quay.io/kentik/ktranslate:v2

2. Copy the snmp-base.yaml file to the local $HOME directory of your Docker user, and discard the container by running the following:

   bash

   Copy

   $
   cd .
   $
   id=$(docker create kentik/ktranslate:v2)
   $
   docker cp $id:/etc/ktranslate/snmp-base.yaml .
   $
   docker rm -v $id

3. In the snmp-base.yaml file, add your network flow devices inside the devices key with the following structure:

   devices:
     flowDevice:
       device_name: edge-router
       device_ip: 10.10.1.254
       flow_only: true
       # Optional user tags
       user_tags:
         owning_team: net_eng
         environment: production

   Copy

   Tip

   If you're already monitoring SNMP data devices that send network flow data, you don't need to add them in your snmp-base.yaml file a second time.

4. Run ktranslate to listen for network flows by running:

   bash

   Copy

   $
   docker run -d --name ktranslate-sflow --restart unless-stopped --net=host \
   >
   -v `pwd`/snmp-base.yaml:/snmp-base.yaml \
   >
   -e NEW_RELIC_API_KEY=$YOUR_NR_LICENSE_KEY \
   >
   kentik/ktranslate:v2 \
   >
     -snmp /snmp-base.yaml \
   >
     -nr_account_id=$YOUR_NR_ACCOUNT_ID \
   >
     ## If your account is located in Europe, add the following flag:
   $
     ## -nr_region=EU \
   $
     ## If you want to use FedRAMP, add the following flag to use the FedRAMP authorized endpoints:
   $
     ## -nr_region=GOV \
   $
     -metrics=jchf \
   >
     -tee_logs=true \
   >
     -flow_only=true \
   >
     -nf.source=sflow \
   >
     -service_name=sflow \
   >
     nr1.flow

   Tip

   This command assumes collection of sflow data. If you are collecting other flow types, you should change the suffix in the --name flag for the container and update the -nf.source and -service_name flags as necessary.

5. To get better visibility into your network device performance, set up SNMP data monitoring.

6. To get insights into system messages from your devices, setup network syslog collection.

7. Visualize your network performance data in New Relic.