Skip to main content

sFlow

Push

Synopsis​

Creates an sFlow collector that accepts flow sampling data over UDP connections. Supports High-Volume collection with multiple workers and configurable buffer sizes.

For details, see Appendix.

Schema​

- id: <numeric>
  name: <string>
  description: <string>
  type: sflow
  tags: <string[]>
  pipelines: <pipeline[]>
  status: <boolean>
  properties:
    address: <string>
    port: <numeric>
    reuse: <boolean>
    buffer_size: <numeric>

Configuration​

The following fields are used to define the device:

Device​

FieldRequiredDefaultDescription
idYUnique identifier
nameYDevice name
descriptionN-Optional description
typeYMust be sflow
tagsN-Optional tags
pipelinesN-Optional pre-processor pipelines
statusNtrueEnable/disable the device

Connection​

FieldRequiredDefaultDescription
addressN"0.0.0.0"Listen address
portN6343Listen port
reuseNtrueEnable socket address reuse

Performance​

FieldRequiredDefaultDescription
buffer_sizeN9000Network read buffer size in bytes

Key Features​

The following are unique features that Director offers.

Multiple Workers​

When reuse is enabled, the collector automatically scales to use multiple worker processes based on available CPU cores. Each worker maintains its own UDP listener, processes flows independently, and writes to a dedicated queue file.

note

The collector automatically scales up to use all available CPU cores.

Flows​

The collector supports interface-counter sampling, packet-flow sampling, application identification, port-based protocol mapping, flow-state tracking, and statistical aggregation.

Examples​

The following are commonly used configuration types.

Basic​

The minimum required configuration using defaults:

Creating a simple sFlow collector...

devices:
  - id: 1
    name: basic_sflow
    type: sflow
    properties:
      port: 6343

High-Volume​

Performance can be enhanced for high flow volumes:

Optimizing for high message volumes...

devices:
  - id: 2
    name: performant_sflow
    type: sflow
    properties:
      address: "0.0.0.0"
      port: 6343
      reuse: true
      buffer_size: 32768

Multiple Agents​

Multiple sFlow agents can be used for collection:

Collecting from multiple network devices...

devices:
  - id: 3
    name: multi_agent_sflow
    type: sflow
    properties:
      address: "0.0.0.0"
      port: 6343
      reuse: true
      buffer_size: 16384
warning

All sFlow agents must be configured to send to the same collector port.

Loading include...

Basic flow collection with application identification...

devices:
  - id: 4
    name: app_aware_sflow
    type: sflow
    properties:
      port: 6343
      reuse: true
      buffer_size: 16384