Skip to content

Commit fdf9dcc

Browse files
committed
README: added reference to UniRec output plugin and example configuration file
1 parent 60b3186 commit fdf9dcc

File tree

3 files changed

+48
-1
lines changed

3 files changed

+48
-1
lines changed

README.rst

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,8 @@ network interface and a port. Multiple instances of these plugins can run concur
3939
- `dummy <src/plugins/output/dummy>`_ - simple module example
4040
- `lnfstore <extra_plugins/output/lnfstore>`_ (*) - store all flows in nfdump compatible
4141
format for long-term preservation
42+
- `UniRec <extra_plugins/output/unirec>`_ (*) - send flow records in UniRec format
43+
via TRAP communication interface (into Nemea modules)
4244

4345
\* Must be installed individually due to extra dependencies
4446

doc/data/configs/tcp2unirec.xml

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
<!--
2+
Receive flow data over TCP, convert them into UniRec format and send via
3+
TCP TRAP communication interface (port 8000).
4+
-->
5+
<ipfixcol2>
6+
<!-- Input plugins -->
7+
<inputPlugins>
8+
<input>
9+
<name>TCP collector</name>
10+
<plugin>tcp</plugin>
11+
<params>
12+
<localPort>4739</localPort>
13+
<localIPAddress></localIPAddress>
14+
</params>
15+
</input>
16+
</inputPlugins>
17+
18+
<!-- Output plugins -->
19+
<outputPlugins>
20+
<output>
21+
<name>UniRec output</name>
22+
<plugin>unirec</plugin>
23+
<params>
24+
<!-- UniRec template -->
25+
<uniRecFormat>TIME_FIRST,TIME_LAST,SRC_IP,DST_IP,PROTOCOL,?SRC_PORT,?DST_PORT,?TCP_FLAGS,PACKETS,BYTES</uniRecFormat>
26+
<!-- TRAP interface configuration -->
27+
<trapIfcCommon>
28+
<timeout>HALF_WAIT</timeout>
29+
<buffer>true</buffer>
30+
<autoflush>500000</autoflush>
31+
</trapIfcCommon>
32+
<!-- TRAP interface specification -->
33+
<trapIfcSpec>
34+
<tcp>
35+
<port>8000</port>
36+
<maxClients>64</maxClients>
37+
</tcp>
38+
</trapIfcSpec>
39+
</params>
40+
</output>
41+
</outputPlugins>
42+
</ipfixcol2>

doc/sphinx/configuration.rst

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -180,6 +180,9 @@ of IPFIXcol. Always keep in mind that you should modify a configuration to fit y
180180
:`multiOutput <../data/configs/multiOutput.xml>`_:
181181
Receive flow data over TCP and store them in a nfdump compatible format on a local drive
182182
and simultaneously send to a remote host as JSON.
183+
:`tcp2unirec <../data/configs/tcp2unirec.xml>_`:
184+
Receive flow data over TCP, convert them into UniRec format and send via TCP TRAP
185+
communication interface (port 8000).
183186

184187
Try your configuration
185188
----------------------
@@ -263,4 +266,4 @@ Verbosity Description
263266
``warning`` Show error and warning messages (i.e. something is not right, but an action can continue)
264267
``info`` Show all previous types of messages and informational (status) messages
265268
``debug`` Show all types of messages (i.e. include messages interesting only for developers)
266-
=========== =========================================================================================
269+
=========== =========================================================================================

0 commit comments

Comments
 (0)