sFlow
Synopsis
Creates an sFlow collector that accepts flow sampling data over UDP connections. Supports high-volume collection with multiple workers.
For details, see Appendix.
Schema
- id: <numeric>
name: <string>
description: <string>
type: sflow
tags: <string[]>
pipelines: <pipeline[]>
status: <boolean>
properties:
address: <string>
port: <numeric>
workers: <numeric>
reuse: <boolean>
Configuration
The following fields are used to define the device:
Device
| Field | Required | Default | Description |
|---|---|---|---|
id | Y | Unique identifier | |
name | Y | Device name | |
description | N | - | Optional description |
type | Y | Must be sflow | |
tags | N | - | Optional tags |
pipelines | N | - | Optional pre-processor pipelines |
status | N | true | Enable/disable the device |
Connection
| Field | Required | Default | Description |
|---|---|---|---|
address | N | "0.0.0.0" | Listen address |
port | N | 6343 | Listen port |
workers | N | One per 8 CPU cores | Number of worker goroutines, never below 1 and reduced further on memory-constrained hosts. Forced to 1 when reuse is false. |
reuse | N | false | Enable socket address reuse |
Ingest Buffer
| Field | Required | Default | Description |
|---|---|---|---|
max_buffer_size | N | 128MB | Ingest buffer admission cap. Also sets this listener's eager heap reservation |
max_buffer_size is the ingest-buffer admission cap, and is distinct from any buffer_size field above, which sizes the network read buffer. Left unset it is 128MB, which commits 384 MiB of heap per listener worker before any data arrives — and with reuse: true a device runs one worker per listener. Size strings are binary, and 32MB and 32MiB are exact synonyms.
See Listener Memory Sizing for the arithmetic, the sizing table, and what happens when the cap is exhausted.
Details
NetFlow, sFlow, and IPFIX devices share a common flow collection backend (backend/module/listener/flow/). The thin per-protocol controller sets the flow type and default port.
When reuse is enabled, the collector scales to one worker process per 8 CPU cores. Each worker maintains its own UDP listener, processes flows independently, and writes to a dedicated queue file. Without reuse the count is forced to 1.
The collector supports interface-counter sampling, packet-flow sampling, application identification, port-based protocol mapping, flow-state tracking, and statistical aggregation.
Examples
The following are commonly used configuration types.
Basic
Creating a simple sFlow collector on the default port... | |
High-Volume
Optimizing for high flow volumes using multiple workers... | |
All sFlow agents must be configured to send to the same collector port.
Application Protocols
The collector supports application-based identification, TCP port mapping, and UDP port mapping. The definition files for these respectively are placed in three locations under <vm_root>:
/user/definitions/app-definitions-{device-id}.csv(device-specific)/user/definitions/app-definitions.csv(user-defined)/package/definitions/app-definitions.csv(system defaults)/user/definitions/tcp-definitions-{device-id}.csv(device-specific)/user/definitions/tcp-definitions.csv(user-defined)/package/definitions/tcp-definitions.csv(system defaults)/user/definitions/udp-definitions-{device-id}.csv(device-specific)/user/definitions/udp-definitions.csv(user-defined)/package/definitions/udp-definitions.csv(system defaults):::warning
Definition files must be in CSV format with exactly two columns per row. :::
The contents of these files are:
app-definitions.csv:
SSH,Secure Shell
RDP,Remote Desktop
HTTP,Web Browsing
HTTPS,Secure Web
tcp-definitions.csv:
22,SSH
3389,RDP
80,HTTP
443,HTTPS
udp-definitions.csv:
53,DNS
67,DHCP
123,NTP
161,SNMP
The collector will fall back on the system defaults if the custom definition files are not found.
sFlow collector with application identification enabled... | |