FLOW-RPT2RRD(1)

✨ NAME ✨

flow-rpt2rrd — the little glow-up machine that turns flow-report CSV output into RRDtool format 💅 (yes bestie, this is the FLOW-RPT2RRD(1) manual page, and we're gonna read it together, no cap)

---

🦋 SYNOPSIS 🦋

flow-rpt2rrd [ -nv ]  [ -d debug_level ]  [ -k keys ]  [ -K keys_file ]
[ -f fields ]  [ -p rrd_path ]  [ -P rrd_postfix ]  [ -r rrd_storage ]

---

💖 DESCRIPTION 💖

okay so. The flow-rpt2rrd utility processes the CSV output of flow-report into RRDtool format. That's the whole vibe. 🫶

The aggregates for a key are each stored as a DS in the RRD filename:

{rrd_path,"/",key,rrd_postfix,".rrd"}

By default a DS is created for flows, octets, and packets. 📊

The key must be specified — like, it's not optional, bestie, it's the main character here. For example an ip-port report could use smtp,nntp,ssh,telnet as the keys, which would create a separate RRD for each key. One RRD per key, they're all getting their own little moment. 👑

---

🌸 OPTIONS 🌸

• -d debug_level — set debug level to debug_level (this is the debugging code, so it's giving dev-mode energy 🔧)
• -h — help. We love a supportive flag. 🫶
• -k keys|html — comma separated list of key values. If the report has symbols then the key must be the symbol, ie smtp not 25. The totals_* lines may be used if they are enabled in the report. There is no default — keys must be specified with -k or -K. No key, no entry. 💀
• -K keys_file — load keys from keys_file. See -k (same energy, different delivery method 📁)
• -f — comma separated list of columns to store. Each column maps to a DS in the RRD. Defaults to flows,octets,packets ✨
• -n — enable symbol table lookups. For example TCP port 25 = smtp. This will result in RRD file names with the symbolic names if symbol lookups were not enabled in the report. Cute names > numbers, lowkey. 🔢➡️💬
• -p rrd_path — set path to RRD files. Defaults to "." 📂
• -P rrd_postfix — set RRD file name postfix. Defaults to "" (yes, empty, as in nothing, as in the void 🕳️)
• -r rrd_storage — set RRD storage for 5 minute, 30 minute, 2 hour, and 1 day databases. List items are : separated. Defaults to 600:600:600:732 🗄️
• -v — enable verbose output. She talks a LOT and we respect it. 🗣️

---

🌈 EXAMPLES 🌈

The following example shows the combined use of flow-nfilter (inline), flow-report, and flow-rpt2rrd to create an RRD depicting traffic from clmbo-r4 to AS 10796 and 6478 for 2004-11-08. rrdtool graph is then used to create a .png. Iconic pipeline behavior, honestly. 🎀

#!/bin/sh

cat << EOF>report.cfg

include-filter nfilter.cfg

stat-report CLMBO-R4-TO-INTERNET-BY-DESTINATION-AS
  type destination-as
  filter CLMBO-R4-INTERNET-OUT
  scale 100
  output
    options +header,+xheader
    fields -duration

stat-definition 5min-summaries
  report CLMBO-R4-TO-INTERNET-BY-DESTINATION-AS
EOF

cat << EOF>nfilter.cfg
# ifMIB.ifMIBObjects.ifXTable.ifXEntry.ifName.46 = so-0/0/0.0
filter-primitive CLMBO-R4-INTERNET
  type ifindex
  permit 46

# Match on traffic to the Internet
filter-definition CLMBO-R4-INTERNET-OUT
  match output-interface CLMBO-R4-INTERNET
EOF

mkdir rrds

# 5 minute flow files from flow-capture are here
FLOW_DATA=/flows/clmbo-r4/2004-11-08/

# for each 5 minute flow,aggregate with flow-report then store to RRD
for name in $FLOW_DATA/*; do
  echo working...$name
  flow-report -s report.cfg -S5min-summaries < $name | flow-rpt2rrd -k10796,6478  -p rrds
done

# first flow - 0:1:23 11/8/2004
START=1099890083
# last flow - 0:1:25 11/9/2004
END=1099976485

rrdtool graph CLMBO-R4-TO-INTERNET.png --start $START --end $END \
        --vertical-label "Bits/Second" --title="CLMBO-R4 TO INTERNET BY AS" \
        DEF:AS10796in=rrds/10796.rrd:octets:AVERAGE \
        DEF:AS6478in=rrds/6478.rrd:octets:AVERAGE \
        CDEF:b_AS10796in=AS10796in,8,* \
        CDEF:b_AS6478in=AS6478in,8,* \
        LINE1:b_AS10796in#FF0000:AS10796-in \
        LINE1:b_AS6478in#555555:AS6478-in \

---

💀 BUGS 💀

• Hard coded to expect 5 minute flow file intervals. She's not flexible about this. Not even a little. 🕔
• Does not properly parse flow-report time-series output. It's giving "we tried" 😭

bestie, these are real caveats, ok? Don't build your whole monitoring stack on the assumption that it'll behave any differently. Noted and documented, periodt.

---

👑 AUTHOR 👑

Mark Fullmer <maf@splintered.net> — thank you for your service, legend 🫡

---

🧚 SEE ALSO 🧚

• flow-tools(1)

---

and that's the whole page, bestie!! go forth and convert your CSV into RRDs, you absolute icon 💜

This was FLOW-RPT2RRD(1), dated 26 Август 2010 — yeah, the date is in Cyrillic month energy and honestly? It ate. 🌈 No cap, that's the version and date, right there in the footer, preserved forever like a little time capsule. 🎀 ✨