Come join our live training webinar every other Wednesday at 11am PST and hear LogicMonitor experts explain best practices and answer common questions. We understand these are uncertain times, and we are here to help!
When the collection of network traffic flow data is correctly configured and enabled, as discussed in Configuring Monitoring for NetFlow, the Resources page displays an additional tab of data for the device, called the Traffic tab.
The Traffic tab consists of built-in tables, graphs, and charts that illustrate common network traffic flow statistics including top talkers, top flows, top source/destination endpoints, top ports, and more. The data can be filtered by a number of criteria and the individual data visualizations that display on the Traffic tab can be added as widgets to your dashboards.
LogicMonitor has a specific data retention policy for exported network traffic flow data. The policy is per interface, and data is sampled and retained according to the following schedule:
The following data is retained:
Network traffic flow data is viewed from the Traffic tab, which displays on the Resources page for devices that have been enabled to collect this data.
In addition to displaying network traffic flow data at device level (in other words, per device), the Traffic tab also displays for device groups that have one or more enabled devices as members.
At the device group level, the Traffic tab aggregates data coming from enabled devices in the group. Group-level aggregation is currently limited to 10 actively contributing network-flow-enabled devices per group. If there are more than 10 actively contributing members per group, the 10 with the lowest device IDs are considered. Device IDs are stored in the system.deviceID property and are auto-incremented with each new device added into monitoring; device IDs cannot be manually updated.
Aggregated network traffic flow data can be very helpful in some use cases. For example, you can use group level data to visualize network traffic on a per-office basis or per-datacenter basis. For more information on device groups, see Device Groups Overview.
The Traffic tab displays widget, table, graph and pie chart visualizations to illustrate commonly collected network traffic flow data. With the exception of the NetFlow Health widget, the time range of these visualizations is controlled by the universal time range currently set in your portal, as discussed in Changing the Time Range.
The Traffic tab consists of the following built-in data visualizations:
Note: You can manipulate the Throughput graph in many of the same ways other graphs throughout the LogicMonitor interface can be manipulated (for example, adding Ops Notes, downloading the graph data, customizing the legend, and so on). For more information, see Graphs Tab.
Note: The Top applications visualization will show as empty unless you have specifically configured your device (and LogicMonitor) to collect NBAR2 data. The requirements and configurations for NBAR2 are discussed in Configuring Monitoring for NetFlow.
In addition to viewing network traffic flow data from the Traffic tab, you can also view this data via reports and dashboards.
The majority of data visualizations that display on the Traffic tab can be added as widgets to one or more of your dashboards using the add to dashboard icon. Any current active filters on the Traffic tab will be preserved by the recipient dashboards; however, because the visualizations are added in the structure of the built-in NetFlow widgets, these filters can be updated from the dashboard at any time (independently of the Traffic tab).
Note: As discussed in Widget Overview, you can also build NetFlow dashboard widgets on a per-device basis from the Dash page. The built-in NetFlow widget offers the same filters as the Traffic tab.
LogicMonitor offers a dedicated report for network traffic flow data. See the NetFlow Device Metric Report for more information.
If you’d like the Traffic tab (and any associated reports or dashboard widgets) to display DNS names in addition to IP addresses other than those that have already resolved, you can provide explicit IP/DNS mappings—either individually or by uploading a CSV file.
Click the cogwheel icon in the upper left corner of the Traffic tab in order to open the IP-DNS Mapping dialog and upload a CSV file.
The following columns should be present in the CSV file:
Once uploaded, mappings are available for editing from the IP-DNS Mappings dialog.
Mappings can be created (or edited) on the fly simply by placing your cursor into any value found in a visualization’s Description column, updating the value, and clicking the Save button that appears at the end of the row. This creates a new or updated entry on the IP-DNS Mappings dialog.
You can filter the traffic flow data that displays on the Traffic tab to optimize relevancy. An active filter is applied to all data visualizations on the Traffic tab.
Filters must be saved before they can be applied. To create and save a set of filter criteria:
Note: Filters are saved on a per-user and per-device (or per-device-group) basis. In other words, only the user who created the filter can access it in the future—and only from the device or device group that was active when the filter was created.
There are several individual filters that can make up a single saved filter set. Each filter’s function is briefly outlined next:
Note: These two NBAR2-specific filters are always present; however, they will have no impact unless you have specifically configured your device (and LogicMonitor) to collect NBAR2 data. The requirements and configurations for NBAR2 are discussed in Configuring Monitoring for NetFlow.
Note: Multiple criterion within a single filter is joined using an OR operator; criteria across multiple filters in the same saved filter set are joined using an AND operator.
In This Article