OSDOCS-6273: Adding packet drop tracking to NetObserv

Author: skrthomas

modules/network-observability-packet-drops.adoc

@@ -0,0 +1,51 @@
+// Module included in the following assemblies:
+//
+// * network_observability/observing-network-traffic.adoc
+
+:_content-type: PROCEDURE
+[id="network-observability-packet-drops_{context}"]
+= Working with packet drops
+Packet loss occurs when one or more packets of network flow data fail to reach their destination. You can track these drops by editing the `FlowCollector` to the specifications in the following YAML example.
+
+[IMPORTANT]
+====
+CPU and memory usage increases when this feature is enabled.
+====
+
+.Prerequisites
+* Access to an {product-title} cluster with version 4.13. 
+* Kernel supported by Red Hat Enterprise Linux (RHEL) 9.2.
+
+.Procedure
+. In the web console, navigate to *Operators* -> *Installed Operators*.
+. Under the *Provided APIs* heading for the *NetObserv Operator*, select *Flow Collector*. 
+. Select *cluster*, and then select the *YAML* tab.
+. Configure the `FlowCollector` custom resource for packet drops, for example:
++
+[id="network-observability-flowcollector-configuring-pkt-drop_{context}"]
+.Example `FlowCollector` configuration
+[source, yaml]
+----
+apiVersion: flows.netobserv.io/v1alpha1
+kind: FlowCollector
+metadata:
+  name: cluster
+spec:
+  namespace: netobserv
+  deploymentModel: DIRECT
+  agent:
+    type: EBPF
+    ebpf:
+      features:
+       - PacketDrop            <1>                         
+      privileged: true       <2>
+----
+<1> You can start reporting the packet drops of each network flow by listing the `PacketDrop` parameter in the `spec.agent.ebpf.features` specification list.   
+<2> The `spec.agent.ebpf.privileged` specification value must be `true` for packet drop tracking.
+
+.Verification
+* When you refresh the *Network Traffic* page, the *Overview*, *Traffic Flow*, and *Topology* views display new information about packet drops:
+.. Select new choices in *Manage panels* to choose which graphical visualizations of packet drops to display in the *Overview*.
+.. Select new choices in *Manage columns* to choose which packet drop information to display in the *Traffic flows* table.  
+... In the *Traffic Flows* view, you can also expand the side panel to view more information about packet drops. 
+.. In the *Topology* view, red lines are displayed where drops are present.

modules/network-observability-pktdrop-overview.adoc

@@ -0,0 +1,25 @@
+// Module included in the following assemblies:
+//
+// network_observability/observing-network-traffic.adoc
+
+:_content-type: CONCEPT
+[id="network-observability-pktdrop-overview_{context}"]
+= Packet drop tracking
+You can configure graphical representation of network flow records with packet loss in the *Overview* view. By employing eBPF tracepoint hooks, you can gain valuable insights into packet drops for TCP, UDP, SCTP, ICMPv4, and ICMPv6 protocols, which can result in the following actions:
+
+* Identification: Pinpoint the exact locations and network paths where packet drops are occurring. Determine whether specific devices, interfaces, or routes are more prone to drops.
+
+* Root cause analysis: Examine the data collected by the eBPF program to understand the causes of packet drops. For example, are they a result of congestion, buffer issues, or specific network events?
+
+* Performance optimization: With a clearer picture of packet drops, you can take steps to optimize network performance, such as adjust buffer sizes, reconfigure routing paths, or implement Quality of Service (QoS) measures.
+
+When packet drop tracking is enabled, you can see the following metrics represented in a chart in the *Overview*. 
+
+* Top X flow dropped rates stacked
+* Total dropped rate
+* Top X dropped state
+* Top X dropped cause
+* Top X flow dropped rates stacked with total
+
+
+See the _Additional Resources_ of this section for more information about enabling and working with packet drop tracking.

modules/network-observability-quickfilter.adoc

@@ -13,14 +13,19 @@ You can use *Query Options* to optimize the search results, as listed below:
 ** *Log Type*: The available options *Conversation* and *Flows* provide the ability to query flows by log type, such as flow log, new conversation, completed conversation, and a heartbeat, which is a periodic record with updates for long conversations. A conversation is an aggregation of flows between the same peers.  
 ** *Reporter Node*: Every flow can be reported from both source and destination nodes. For cluster ingress, the flow is reported from the destination node and for cluster egress, the flow is reported from the source node. You can select either *Source* or *Destination*. The option *Both* is disabled for the *Overview* and *Topology* view. The default selected value is *Destination*.
 ** *Match filters*: You can determine the relation between different filter parameters selected in the advanced filter. The available options are *Match all* and *Match any*. *Match all*  provides results that match all the values, and *Match any* provides results that match any of the values entered. The default value is *Match all*.
+** *Drops filter*: You can view different levels of dropped packets with the following query options:
+*** *Fully dropped* shows flow records with fully dropped packets.
+*** *Containing drops* shows flow records that contain drops but can be sent.
+*** *Without drops* shows records that contain sent packets.
+*** *All* shows all the aforementioned records.
+
 ** *Limit*: The data limit for internal backend queries. Depending upon the matching and the filter settings, the number of traffic flow data is displayed within the specified limit.
 
 Quick filters::
 The default values in *Quick filters* drop-down menu are defined in the `FlowCollector` configuration. You can modify the options from console. 
 
 Advanced filters::
 You can set the advanced filters by providing the parameter to be filtered and its corresponding text value. The section *Common* in the parameter drop-down list filters the results that match either *Source* or *Destination*. To enable or disable the applied filter, you can click on the applied filter listed below the filter options.
-
 [NOTE]
 ====
 To understand the rules of specifying the text value, click *Learn More*.

networking/network_observability/observing-network-traffic.adoc

@@ -12,14 +12,21 @@ As an administrator, you can observe the network traffic in the {product-title}
 include::modules/network-observability-overview.adoc[leveloffset=+1]
 include::modules/network-observability-working-with-overview.adoc[leveloffset=+2]
 include::modules/network-observability-configuring-options-overview.adoc[leveloffset=+2]
+include::modules/network-observability-pktdrop-overview.adoc[leveloffset=+3]
+
+[role="_additional-resources"]
+.Additional resources
+* For more information about configuring packet drops in the `FlowCollector`, see xref:../network_observability/observing-network-traffic.adoc#network-observability-packet-drops_nw-observe-network-traffic[Working with packet drops].
+
 
 //Traffic flows
 include::modules/network-observability-trafficflow.adoc[leveloffset=+1]
 include::modules/network-observability-working-with-trafficflow.adoc[leveloffset=+2]
 include::modules/network-observability-configuring-options-trafficflow.adoc[leveloffset=+2]
 include::modules/network-observability-working-with-conversations.adoc[leveloffset=+2]
-
+include::modules/network-observability-packet-drops.adoc[leveloffset=+2]
 include::modules/network-observability-histogram-trafficflow.adoc[leveloffset=+2]
+
 //Topology
 include::modules/network-observability-topology.adoc[leveloffset=+1]
 include::modules/network-observability-working-with-topology.adoc[leveloffset=+2]