IPFIX Log Sending
About
IPFIX Log Sending action for a vService is the process of sending IPFIX logs to the specified IP:Port (UDP) at Collector Address based on the sending type specified at Send Type. IPFIX Log Sending can be used both at request and response time.
How to Add?
To add the IPFIX Log Sending action from TR7 ASP web interface, "Traffic Manager > Traffic Manipulation > Actions > Add" steps are followed. At the current page IPFIX Log Sending is selected as an Action Type and the following form is shown.
Applicable vServices
- HTTP
- L7 TCP
- Network
Interface
IPFIX Log Sending Form
- Action Name
Name for the action is entered.
- Action Type
"IPFIX Log Sending" is selected.
- Collector Address
The IP and Port information of the server that the IPFIX Logs will be sent is entered. After the IP and Port information is given, Collector Address section can be seen as below. TR7 automatically detects whether the type of IP address is IPv4 or IPv6.
- Send Type
When send type is chosen as Enterprise, 8 IPFIX Log names are edited by TR7. Edited logs can be seen in the table below. To learn more about sending IPFIX logs to Graylog servers with Enterprise log type, click here.
| IPFIX ENTERPRISE LOG (TR7) | IPFIX STANDARD LOG |
|---|---|
| uploadedBytes (ID=1001) | initiatorOctets (ID=231) |
| downloadedBytes (ID=1002) | responderOctets (ID=232) |
| httpRequestQuery (ID=1003) | httpReasonPhrase (ID=470) |
| httpXForwardedFor (ID=1004) | observationDomainName (ID=300) |
| httpReferrer (ID=1005) | virtualStationName (ID=350) |
| httpCookie (ID=1006) | applicationCategoryName (ID=372) |
| httpResponseContentType (ID=1007) | applicationGroupName (ID=374) |
| httpTerminationStateCode (ID=1008) | informationElementDescription (ID=340) |
Detailed explanation of IPFIX Standard logs can be viewed at https://www.iana.org/assignments/ipfix/ipfix.xhtml. To learn more about sending IPFIX logs to Graylog servers with Standard log type, click here.
| IPFIX STANDARD LOG | IPFIX ENTERPRISE LOG (TR7) |
|---|---|
| initiatorOctets (ID=231) | uploadedBytes (ID=1001) |
| responderOctets (ID=232) | downloadedBytes (ID=1002) |
| httpReasonPhrase (ID=470) | httpRequestQuery (ID=1003) |
| observationDomainName (ID=300) | httpXForwardedFor (ID=1004) |
| virtualStationName (ID=350) | httpReferrer (ID=1005) |
| applicationCategoryName (ID=372) | httpCookie (ID=1006) |
| applicationGroupName (ID=374) | httpResponseContentType (ID=1007) |
| informationElementDescription (ID=340) | httpTerminationStateCode (ID=1008) |
- Example IPFIX Logs Received from Graylog
- Form Buttons
Add button can be clicked to add the configured action.
Add & Repeat button can be clicked to add the configured action. New similar actions can also be added without losing the current configuration by clicking this button. The following alert is shown when the button is clicked.
Condition Requirement
IPFIX Log Sending action does not require a condition.