Feature suggestions: Combine interfaces in reports

Scrutinizer is an enterprise/business class NetFlow and sFlow analysis tool. Scrutinizer provides historical trends of the company's critical network interfaces as well as the details on:

Who: The end system causing the traffic
What: The application/protocol that is being used
When: The time frame it has been occurring for
Where: The network connection that is affected

Moderators: scottr, Moderator Team

Post Reply
filobeddo
Posts: 22
Joined: Fri Apr 08, 2011 9:27 am
Location: London, England

Feature suggestions: Combine interfaces in reports

Post by filobeddo » Tue Oct 06, 2015 6:08 am

Hi Knights!

Just a feature suggestion which you might like to have a view on.

When creating reports how about the option under filters to combine two (or maybe more) interfaces, i.e. aggregate their data together; perhaps call this a virtual interface?

As an explanation of what this would achieve see my following real-world example:

Our server layer multilayer-switches exist with a dual layer3 path to our core layer. And so take advantage of layer3 load-sharing.

When I am interested in client-A's traffic between server-X I need to look at a pair of reports. I have to firstly look at server layer 3 interface #1 and then modify my filter to look at interface #2.

What would be really handy would be if I were able to have a single view of the aggregate of interfaces #1 & #2. This way I could see all of the data I am interested in via a single report and not have to switch filters.

Just an idea........

ryans
Posts: 25
Joined: Mon Aug 04, 2014 10:47 am

Re: Feature suggestions: Combine interfaces in reports

Post by ryans » Tue Oct 06, 2015 7:57 am

Hello filobeddo,

If i read your post correctly, Scrutinizer already does what you are suggesting. When you add in 2 filters, one for interface #1 and one for interface #2, you will see all the traffic going across both interfaces.

Thank you,
Ryan

filobeddo
Posts: 22
Joined: Fri Apr 08, 2011 9:27 am
Location: London, England

Re: Feature suggestions: Combine interfaces in reports

Post by filobeddo » Wed Oct 07, 2015 5:32 am

Great Ryan thanks. I had no idea that this was already something I could do via the filters.
Perfect, I was able to add a second device/interface to my current query and get the combined output which I mentioned in my initial post.

Many thanks, hopefully others (like me) did not know you could do this and will find this useful.

I note that when doing this the 'flow view' report is unavailable. I assume this due to the complexity this query must incur in the background.

maciejw
Posts: 13
Joined: Tue May 12, 2015 5:35 pm

Re: Feature suggestions: Combine interfaces in reports

Post by maciejw » Tue Oct 13, 2015 4:45 pm

Hi filobeddo,

Go to Admin>Settings>System Preferences and find Maximum Flow View Exporters, 3/4 down the page. By default, it's set to 1. Thus Flow View is not an option when viewing multiple interfaces. Though, if you increase the number of exporters, you'll have the Flow View as an option again. Might take some time to load ;)

Regards,
- Maciej

Post Reply

Who is online

Users browsing this forum: No registered users and 4 guests