sFlow Topic: Monitoring VM traffic using sFlow Setup: Two Physical Networks: Data Network: Ethernet network for VM data traffic. For experimentation, this physical network is optional. You can instead connect all VMs to a bridge that is not connected to a physical interface. Management Network: This network must exist, as it is used to send sFlow data from the agent to the remote collector. Two Physical Hosts: “Host1″ runs Open vSwitch and has two NICs: eth0 is connected to the Data Network. No IP address can be assigned on eth0. eth1 is connected to the Management Network. eth1 has an IP address for management traffic (including sFlow). “Monitoring Host” can be any computer that can run the sFlow collector. For this cookbook entry, we use sFlowTrend, a free sFlow collector that is a simple cross-platform Java download. Other sFlow collectors should work equally well. eth0 is connected to the Management Network. eth0 has an IP address that can reach Host1. Two VMs: VM1,VM2 run on Host1. Each VM has a single interface that appears as a Linux device (e.g., “tap0″) on the physical host. (Note: for Xen/XenServer, VM interfaces appears as Linux devices with names like “vif1.0″) Goal: Monitor traffic sent to/from VM1 and VM2 on the Data network (including traffic between two VMs on the same physical host) using an sFlow collector. Configuration: Define the following configuration values in your shell environment. 6343 is the default port number for sFlowTrend. You will want to set your own IP address for the collector in the place of 10.0.0.1. Setting the AGENT_IP value to eth1 indicates that the sFlow agent should send traffic from eth1′s IP address. The other values indicate settings regarding the frequency and type of packet sampling that sFlow should perform. COLLECTOR_IP=10.0.0.1 COLLECTOR_PORT=6343 AGENT_IP=eth1 HEADER_BYTES=128 SAMPLING_N=64 POLLING_SECS=10 Run the following command to create an sFlow configuration and attach it to bridge br0: ovs-vsctl — –id=@sflow create sflow agent=${AGENT_IP} target=”${COLLECTOR_IP}:${COLLECTOR_PORT}” header=${HEADER_BYTES} sampling=${SAMPLING_N} polling=${POLLING_SECS} — set bridge br0 sflow=@sflow That is all. To configure sFlow on additional bridges, just replace ‘br0′ in the above command with a different bridge name. To remove sFlow configuration from a bridge (in this case, ‘br0′), run: ovs-vsctl remove bridge br0 sflow $SFLOWUUID To see all current sets of sFlow configuration parameters, run: ovs-vsctl list sflow Trouble-Shooting: Make sure the VMs are sending/receiving network traffic over bridge br0, preferably to multiple other hosts and using a variety of protocols. Go to the sFlowTrend homepage and click ‘install’ in the upper right hand corner. If you have java installed, this will download and start the sFlowTrend application. The light in the lower right-hand corner of the sFlowTrend application should blink green to indicate that the collector is receiving traffic. To confirm that the agent is sending traffic, check that running the following command shows that the agent on the physical server is sending traffic to the collector IP address: tcpdump -ni eth1 udp port 6343 If no traffic is being sent, there is a problem with the configuration of OVS. If traffic is being sent but nothing is visible in the sFlowTrend user interface, this may be a configuration problem with the collector. Also check to make sure the host running the collector does not have a firewall that would prevent UDP port 6343 from reaching the collector. If you have problems with this cookbook entry, please send them to the OVS discuss email list. Credit: This cookbook entry is heavily based on content from Neil McKee at InMon: openvswitch.org/pipermail/dev_openvswitch.org/2010-July/002583.html blog.sflow/2010/01/open-vswitch.html (note: configuration syntax is out of date, but the high-level descriptions are correct).
Posted on: Sat, 06 Jul 2013 04:36:06 +0000