Sending flow data from a switch direct to ExtremeAnalytics (without a flowcollector engine)

[Yves_Haslimann]

Hello everybody

I would like to configure the Extreme Switches (x440-G2, with version 22.4) to sending sflow/netflow data direct to the Extreme Analytics. I heard this is now possible without having a flowcollector enginge like PV FC-180 installed. Is this true? Because I couldn't find any referenced documentation to this. Thank you very much for your feedback.

Best regards, Yves

[OscarK]

You add the app telemetry source under flow sources.
Maybe the sflow.pol file is only created once you do a first enforce.
On the switch I think all should be configured by Analytics.

[Yves_Haslimann]

I don't have a sflow.pol file.
And how/where can I add a "application telemetry source"?

What do I have to configure on the switch side?

Thank you

[OscarK]

Ok, some file editing is needed now to make it work.
On XMC, copy sflow,pol.
cp /usr/local/Extreme_Networks/NetSight/appdata/Purview/Fingerprints/sflow.pol /tftpboot/

On Analytics, edit file /opt/appid/conf/appidconfig.xml and change interfaces to be like:






Restart analytics or appid after this.

On XMC go to analytics, configuration and on your engine add an application telemetry source (the switch) and enforce.

[OscarK]

sflow together with a mirror config.

TestAnalytics.1 # sh sflow
SFLOW Global Configuration
Global Status: enabled
Polling interval: 60
Sampling rate: 1024
Maximum cpu sample limit: 2000
SFLOW Configured Agent IP: 10.116.3.89 Operational Agent IP: 10.116.3.89
Collectors
Collector IP 10.116.2.209, Port 6343, VR "VR-Default"

SFLOW Port Configuration
Port Status Sample-rate Subsampling Sflow-type
Config / Actual factor Ingress / Egress
1 enabled 1024 / 1024 1 enabled / disabled
2 enabled 1024 / 1024 1 enabled / disabled
TestAnalytics.2 # sh mirror

DefaultMirror (Disabled)
Description: Default Mirror Instance, created automatically
Mirror to port: -

EAN (Enabled)
Description:
Mirror to remote IP: 10.116.2.209 VR : VR-Default
From IP : 10.116.3.89 Ping check: Off
Status : Up

Mirrors defined: 2
Mirrors enabled: 1 (Maximum 4)
HW filter instances used: 0 (Maximum 128)

[Yves_Haslimann]

Hi Oskar, it's me again. Are we talking here about sflow+ ? Because my workmate said, it has to run with sflow+ and not only with sflow.