<!DOCTYPE refentry PUBLIC "-//Davenport//DTD DocBook V3.0//EN">
<refentry>

<refmeta>
<refentrytitle>
<application>flow-rpt2rrd</application>
</refentrytitle>
<manvolnum>1</manvolnum>
</refmeta>

<refnamediv>
<refname>
<application>flow-rpt2rrd</application>
</refname>
<refpurpose>
Convert flow-report CSV output to RRDtool format.
</refpurpose>
</refnamediv>

<refsynopsisdiv>
<cmdsynopsis>
<command>flow-rpt2rrd</command>
<arg>-nv</arg>
<arg>-d<replaceable> debug_level</replaceable></arg>
<arg>-k<replaceable> keys</replaceable></arg>
<arg>-K<replaceable> keys_file</replaceable></arg>
<arg>-f<replaceable> fields</replaceable></arg>
<arg>-p<replaceable> rrd_path</replaceable></arg>
<arg>-P<replaceable> rrd_postfix</replaceable></arg>
<arg>-r<replaceable> rrd_storage</replaceable></arg>
</cmdsynopsis>
</refsynopsisdiv>

<refsect1>
<title>DESCRIPTION</title>
<para>
The <command>flow-rpt2rrd</command> utility processes the CSV output of
flow-report into RRDtool format.  The aggregates for a key are each
stored as a DS in RRD filename {rrd_path,"/",key,rrd_postfix,".rrd"}.
By default a DS is created for flows, octets, and packets.  The key
must be specified, for example an ip-port report could use smtp,nntp,ssh,telnet
as the keys which would create a separate RRD for each key.
</para>
</refsect1>

<refsect1>
<title>OPTIONS</title>
<variablelist>

<varlistentry>
<term>-d<replaceable> debug_level</replaceable></term>
<listitem>
<para>
Set debug level to debug_level (debugging code)
</para>
</listitem>
</varlistentry>

<varlistentry>
<term>-h</term>
<listitem>
<para>
Help.
</para>
</listitem>
</varlistentry>

<varlistentry>
<term>-k<replaceable> keys</replaceable>|<replaceable>html</replaceable</term>
<listitem>
<para>
Comma separated list of key values.  If the report has symbols
then the key must be the symbol, ie smtp not 25.  The totals_* lines
may be used if they are enabled in the report.  There is no default, 
keys must be specified with -k or -K.
</para>
</listitem>
</varlistentry>

<varlistentry>
<term>-K<replaceable> keys_file</replaceable></term>
<listitem>
<para>
Load keys from <replaceable>keys_file</replaceable>.  See -k.
</para>
</listitem>
</varlistentry>

<varlistentry>
<term>-f</term>
<listitem>
<para>
Comma separated list of columns to store.  Each column maps to a DS in the
RRD.  Defaults to flows,octets,packets
</para>
</listitem>
</varlistentry>

<varlistentry>
<term>-n</term>
<listitem>
<para>
Enable symbol table lookups.  For example TCP port 25 = smtp.  This will
result in RRD file names with the symbolic names if symbol lookups were
not enabled in the report.
</para>
</listitem>
</varlistentry>

<varlistentry>
 <term>-p<replaceable> rrd_path</replaceable></term>
<listitem>
<para>
Set path to RRD files.  Defaults to ".".
</para>
</listitem>
</varlistentry>

<varlistentry>
<term>-P<replaceable> rrd_postfix</replaceable></term>
<listitem>
<para>
Set RRD file name postfix.  Defaults to "".
</para>
</listitem>
</varlistentry>

<varlistentry>
<term>-r<replaceable> rrd_storage</replaceable></term>
<listitem>
<para>
Set RRD storage for 5 minute, 30 minute, 2 hour, and 1 day databases.  List
items are : seperated.  Defaults to 600:600:600:732.
</para>
</listitem>
</varlistentry>

<varlistentry>
<term>-v</term>
<listitem>
<para>
Enable verbose output.
</para>
</listitem>
</varlistentry>

</variablelist>
</refsect1>

<refsect1>
<title>EXAMPLES</title>
<informalexample>
<screen>
The following example shows the combined use of flow-nfilter (inline), 
flow-report, and flow-rpt2rrd to create an RRD depicting traffic 
from clmbo-r4 to AS 10796 and 6478 for 2004-11-08.  rrdtool graph is
then used to create a .png.

#!/bin/sh

cat &lt&lt EOF>report.cfg

include-filter nfilter.cfg

stat-report CLMBO-R4-TO-INTERNET-BY-DESTINATION-AS
  type destination-as
  filter CLMBO-R4-INTERNET-OUT
  scale 100
  output   
    options +header,+xheader
    fields -duration

stat-definition 5min-summaries
  report CLMBO-R4-TO-INTERNET-BY-DESTINATION-AS
EOF

cat &lt&lt EOF>nfilter.cfg
# ifMIB.ifMIBObjects.ifXTable.ifXEntry.ifName.46 = so-0/0/0.0
filter-primitive CLMBO-R4-INTERNET
  type ifindex
  permit 46

# Match on traffic to the Internet
filter-definition CLMBO-R4-INTERNET-OUT
  match output-interface CLMBO-R4-INTERNET
EOF

mkdir rrds

# 5 minute flow files from flow-capture are here
FLOW_DATA=/flows/clmbo-r4/2004-11-08/

# for each 5 minute flow,aggregate with flow-report then store to RRD
for name in $FLOW_DATA/*; do
  echo working...$name
  flow-report -s report.cfg -S5min-summaries < $name | flow-rpt2rrd -k10796,6478  -p rrds
done

# first flow - 0:1:23 11/8/2004
START=1099890083
# last flow - 0:1:25 11/9/2004
END=1099976485

rrdtool graph CLMBO-R4-TO-INTERNET.png --start $START --end $END \
        --vertical-label "Bits/Second" --title="CLMBO-R4 TO INTERNET BY AS" \
        DEF:AS10796in=rrds/10796.rrd:octets:AVERAGE \
        DEF:AS6478in=rrds/6478.rrd:octets:AVERAGE \
        CDEF:b_AS10796in=AS10796in,8,* \
        CDEF:b_AS6478in=AS6478in,8,* \
        LINE1:b_AS10796in#FF0000:AS10796-in \
        LINE1:b_AS6478in#555555:AS6478-in \

</screen>
</informalexample>

</refsect1>


<refsect1>
<title>BUGS</title>
<para>
Hard coded to expect 5 minute flow file intervals.  Does not properly parse
flow-report time-series output.
</para>
</refsect1>

<refsect1>
<title>AUTHOR</title>
<para>
<author>
<firstname>Mark</firstname>
<surname>Fullmer</surname>
</author>
<email>maf@splintered.net</email>
</para>
</refsect1>

<refsect1>
<title>SEE ALSO</title>
<para>
<application>flow-tools</application>(1)
</para>
</refsect1>

</refentry>
