Skip to content

Added new flow-accounting options #2175

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
srividya0208 wants to merge 1 commit into
base: rolling
Choose a base branch
from
Open

Added new flow-accounting options #2175

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
89 changes: 31 additions & 58 deletions docs/configuration/system/flow-accounting.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,12 +9,6 @@ Flows can be exported via protocol NetFlow (versions 5, 9 and
10/IPFIX). Additionally, you may save flows to an in-memory table
internally in a router.

:::{warning}
You need to disable the in-memory table in production environments!
Using {abbr}`IMT (In-Memory Table)` may lead to heavy CPU overloading and
unstable flow-accounting behavior.
:::

## NetFlow / IPFIX

NetFlow is a feature that was introduced on Cisco routers around 1996 that
Expand Down Expand Up @@ -44,57 +38,19 @@ exported.
Using NetFlow on routers with high traffic levels may lead to
high CPU usage and may affect the router's performance. In such cases,
consider using sFlow instead.
:::

In order for flow accounting information to be collected and displayed for an
interface, the interface must be configured for flow accounting.

```{cfgcmd} set system flow-accounting interface \<interface\>

Configure and enable collection of flow information for the interface
identified by \<interface\>.

You can configure multiple interfaces which would participate in flow
accounting.
```

:::{note}
Will be recorded only packets/flows on **incoming** direction in
configured interfaces by default.
:::

By default, recorded flows will be saved internally and can be listed with the
CLI command. You may disable using the local in-memory table with the command:

```{cfgcmd} set system flow-accounting disable-imt

If you need to sample also egress traffic, you may want to
configure egress flow-accounting:
```

```{cfgcmd} set system flow-accounting enable-egress

Internally, in flow-accounting processes exist a buffer for data exchanging
between core process and plugins (each export target is a separated plugin).
If you have high traffic levels or noted some problems with missed records
or stopping exporting, you may try to increase a default buffer size (10
MiB) with the next command:
If you need to sample also egress traffic, you may want to configure egress
flow-accounting.
```

```{cfgcmd} set system flow-accounting buffer-size \<buffer size\>
```{cfgcmd} set system flow-accounting vrf <name>

In case, if you need to catch some logs from flow-accounting daemon, you may
configure logging facility:
Configure the VRF instance for sending flow-data
```

```{cfgcmd} set system flow-accounting syslog-facility \<facility\>

Set the syslog facility for flow-accounting log messages. Supported values
include ``daemon``, ``local0`` through ``local7``, and other standard syslog
facilities.
```


### Flow Export

In addition to displaying flow accounting information locally, one can also
Expand All @@ -112,16 +68,30 @@ versions are supported:
* **10** - {abbr}`IPFIX (IP Flow Information Export)` as per {rfc}`3917`
```

In order for flow accounting information to be collected and displayed for an
interface, the interface must be configured for flow accounting.

```{cfgcmd} set system flow-accounting netflow interface \<interface\>

Configure and enable collection of flow information for the interface
identified by \<interface\>.

You can configure multiple interfaces which would participate in flow
accounting.
```

:::{note}
Will be recorded only packets/flows on **incoming** direction in
configured interfaces by default.
Comment on lines +84 to +85
:::


```{cfgcmd} set system flow-accounting netflow server \<address\>

Configure address of NetFlow collector. NetFlow server at \<address\> can
be both listening on an IPv4 or IPv6 address.
```

```{cfgcmd} set system flow-accounting netflow source-ip \<address\>

IPv4 or IPv6 source address of NetFlow packets
```

```{cfgcmd} set system flow-accounting netflow engine-id \<id\>

Expand All @@ -141,13 +111,16 @@ flows.
Per default every packet is sampled (that is, the sampling rate is 1).
```

```{cfgcmd} set system flow-accounting netflow timeout expiry-interval \<interval\>
```{cfgcmd} set system flow-accounting netflow active-timeout \<value\>

Specifies the interval at which Netflow data will be sent to a collector. As
per default, Netflow data will be sent every 60 seconds.
Specifies the duration, in seconds, that an active flow is maintained before it is exported.
By default, active flows are exported after 1800 seconds (30 minutes).
```

```{cfgcmd} set system flow-accounting netflow inactive-timeout \<value\>

You may also additionally configure timeouts for different types of
connections.
Specifies the duration, in seconds, that an inactive flow is retained before it is exported. A flow is considered inactive if no new packets are observed for the configured interval.
By default, inactive flows are exported after 15 seconds. This parameter defaults to a value of 15.
Comment on lines +114 to +123

@coderabbitai coderabbitai Bot Jul 30, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Wrap timeout descriptions to 80 characters.

Lines 116 and 122 exceed the documentation line-length limit; line 122 also contains trailing whitespace. Keep the MyST directive openers unchanged, but wrap the prose body lines.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/configuration/system/flow-accounting.md` around lines 114 - 123, Wrap
the prose descriptions under the netflow active-timeout and inactive-timeout
directives so no line exceeds 80 characters, while keeping the directive opener
lines unchanged. Remove the trailing whitespace on the affected inactive-timeout
text.

Sources: Coding guidelines, Learnings

```

```{cfgcmd} set system flow-accounting netflow max-flows \<n\>
Expand Down Expand Up @@ -206,4 +179,4 @@ eth0 00:53:01:b2:22:48 00:53:02:58:a2:92 192.0.2.100 192.0.2.14
eth0 00:53:01:b2:22:48 00:53:02:58:a2:92 192.0.2.100 192.0.2.14 40152 22 tcp 16 94 1 4924
eth0 00:53:01:b2:22:48 00:53:02:58:a2:92 192.0.2.100 192.0.2.14 0 0 icmp 192 36 1 5877
:::
```
```
Loading