Monitoring System Statistics and Network Traffic with sFlow

To enable sFlow:

cumulus@switch:~$ nv set system sflow state enabled 
cumulus@switch:~$ nv config apply

To disable sFlow, run the nv set system sflow state disabled command.

By default, the hsflowd service is disabled and does not start automatically when the switch boots up.

To enable and start the hsflowd service:

cumulus@switch:~$ sudo systemctl enable hsflowd
cumulus@switch:~$ sudo systemctl start hsflowd

To disable the hsflowd service:

cumulus@switch:~$ sudo systemctl stop hsflowd
cumulus@switch:~$ sudo systemctl disable hsflowd

Specify the IP address, UDP port number, and interface for the designated collectors. The port number and interface are optional; If you do not specify a port number, Cumulus Linux uses the default port 6343.

The following example configures sFlow to send data to collector 192.0.2.100 on port 6343 and collector 192.0.2.200 on eth0:

cumulus@switch:~$ nv set system sflow collector 192.0.2.100 port 6344
cumulus@switch:~$ nv set system sflow collector 192.0.2.200 interface eth0
cumulus@switch:~$ nv config apply

Configure the sFlow sampling rate in number of packets if you do not want to use the default rate, and the polling interval in seconds.

The following example polls the counters every 20 seconds and samples one in every 40000 packets for 40G interfaces:

cumulus@switch:~$ nv set system sflow sampling-rate speed-40g default 40000
cumulus@switch:~$ nv set system sflow poll-interval 20
cumulus@switch:~$ nv config apply

Edit the /etc/hsflowd.conf file to set up the collectors, sampling rates, and polling interval in seconds, then restart the hsflowd service with the sudo systemctl start hsflowd command.

The following example polls the counters every 20 seconds, samples 1 of every 40000 packets for 40G interfaces, and sends this information to a collector at 192.0.2.100 on port 6343 and to another collector at 192.0.2.200 on interface eth0.

cumulus@switch:~$ sudo nano /etc/hsflowd.conf
sflow {
# ====== Sampling/Polling/Collectors ======
  # EITHER: automatic (DNS SRV+TXT from _sflow._udp):
  #   DNS-SD { }
  # OR: manual:
  #   Counter Polling:
        polling = 20
  #   default sampling N:
  #     sampling = 400
  #   sampling N on interfaces with ifSpeed:
        sampling.100M = 100
        sampling.1G = 1000
        sampling.10G = 10000
        sampling.40G = 40000
  #   sampling N for apache, nginx:
  #     sampling.http = 50
  #     sampling N for application (requires json):
  #     sampling.app.myapp = 100
  #   collectors:
  collector { ip=192.0.2.100 udpport=6344 }
  collector { ip=192.0.2.200 interface=eth0 }
}

cumulus@switch:~$ sudo systemctl start hsflowd

The following example configures the sFlow agent prefix to 10.0.0.0/8:

cumulus@switch:~$ nv set system sflow agent ip 10.0.0.0/8 

The following example configures the sFlow agent interface to eth0:

cumulus@switch:~$ nv set system sflow agent interface eth0
cumulus@switch:~$ nv config apply

To provide the IP address or prefix for the sFlow agent, edit the /etc/hsflowd.conf file to set the agent.CIDR parameter, then restart the hsflowd service with the sudo systemctl start hsflowd command.

cumulus@switch:~$ sudo nano /etc/hsflowd.conf
...
sflow { 
  agent.CIDR = 10.0.0.0/8 
} 

cumulus@switch:~$ sudo systemctl start hsflowd

To provide an interface for the sFlow agent, edit the /etc/hsflowd.conf file to set the agent parameter, then restart the hsflowd service with the sudo systemctl start hsflowd command.:

cumulus@switch:~$ sudo nano /etc/hsflowd.conf
...
sflow { 
  agent = eth0 
} 

cumulus@switch:~$ sudo systemctl start hsflowd

cumulus@switch:~$ nv set  system sflow policer rate 8000
cumulus@switch:~$ nv set  system sflow policer burst 9000
cumulus@switch:~$ nv config apply

Edit the /etc/cumulus/datapath/traffic.conf file to change the sflow.rate and sflow.burst parameters, then reload switchd with the sudo systemctl reload switchd.service command.

cumulus@switch:~$ sudo nano /etc/cumulus/datapath/traffic.conf
# Set sflow/sample ingress cpu packet rate and burst in packets/sec 
# Values: {0..16384} 
sflow.rate = 8000
sflow.burst = 9000 

cumulus@switch:~$ sudo systemctl reload switchd.service 

cumulus@switch:~$ nv set interface swp1 sflow state disabled 
cumulus@switch:~$ nv config apply

To enable sFlow on an interface, run the nv set interface <interface> sflow state enabled command.

By default, sFlow is enabled on interfaces that are operationally UP. To disable sFlow on a specific interface, edit the /etc/cumulus/switchd.conf file and set the interface.<interface>.sflow.enable parameter to FALSE:

cumulus@switch:~$ sudo nano /etc/cumulus/switchd.conf
interface.swp1.sflow.enable = FALSE 

To enable sFlow on an interface, set the interface.<interface>.sflow.enable parameter to TRUE.

cumulus@switch:~$ nv set interface swp1 sflow sample-rate 100000
cumulus@switch:~$ nv config apply

Edit the /etc/cumulus/switchd.conf file and set the interface.<interface-id>.sflow.sample_rate.ingress parameter:

cumulus@switch:~$ sudo nano /etc/cumulus/switchd.conf
interface.swp1.sflow.sample_rate.ingress = 100000 

The following example configures sFlow to monitor dropped packets in software:

cumulus@switch:~$ nv set system sflow dropmon sw 
cumulus@switch:~$ nv config apply

The following example configures sFlow to monitor dropped packets in hardware:

cumulus@switch:~$ nv set system sflow dropmon hw 
cumulus@switch:~$ nv config apply

Edit the /etc/hsflowd.conf file to add the dropmon { group=1 start=on sw=off hw=on } line to monitor dropped packets in hardware or the dropmon { group=1 start=on sw=on hw=off } line to monitor dropped packets in software:

cumulus@switch:~$ sudo nano /etc/hsflowd.conf
dropmon { group=1 start=on sw=off hw=on }

Restart the hsflowd service with the sudo systemctl start hsflowd command.