To configure Netflow on a Linux server, you will need to install softflowd. softflowd is a software-based NetFlow exporter for Unix-like operating systems, and it allows you to export flow data to your Auvik collector for traffic analysis.
Note: Before you start, ensure that you have administrative access to your Linux server.
1. Install softflowd:
You can install softflowd using your distribution's package manager. For example, on Debian/Ubuntu-based systems, use:
sudo apt-get update
sudo apt-get install softflowd
On CentOS/RHEL-based systems, you can use:
sudo yum install softflowd
2. Create a Configuration File:
softflowd uses a configuration file to specify which network interface to monitor and where to export flow data. Edit the default configuration file /etc/softflowd/default.conf with the following command:
nano /etc/softflowd/default.conf
Add the following content as a basic example:
#
# configuration for a single softflowd instance
#
# See /usr/share/doc/softflowd/README.Debian
# The interface softflowd listens on. You may also use "any" to listen
# on all interfaces. Mandatory.
interface='eth0'
# Further options for softflowd, see "man softflowd" for details.
# You should at least define a host and a port where the accounting
# datagrams should be sent to, e.g.
# options="-n 127.0.0.1:9995"
# You may override the control socket location (-c) if you really want to.
# Do not override the pid file location (-p).
options='-v 10 -n 10.0.10.50:2055 -s 512'
- Modify eth0 to the appropriate network interface you want to monitor. If you don’t know the name of the interface you wish to monitor you can find the name with ifconfig
- Adjust the IP address to match that of your Auvik Collector.
3. Start softflowd:
Start the Softflowd service with the following command:
sudo systemctl start softflowd
4. Enable softflowd on Boot:
To ensure Softflowd starts automatically on system boot, enable the service:
sudo systemctl enable softflowd
5. Firewall Configuration:
Ensure that your server's firewall allows outgoing traffic to the collector's IP address and port. If your server is running a firewall, adjust the rules accordingly.
6. Verify softflowd Operation:
You can verify that softflowd is running and exporting flow data by checking the logs or using command-line tools like `softflowctl`. For example, you can use the following command to view softflowd's status:
softflowctl status
You should see information about the network interface being monitored and the collector's details.