EV Observe - Use NetworkAnalysis-sFlow Service Template

Last modified on 2023/01/12 18:13

The NetworkAnalysis-sFlow service template analyzes nfcapd export files stored on the sFlow collector in order to establish statistics on bandwidth usage of network interfaces monitored by sFlow.

  • It is used to monitor and analyze bandwidth consumption by focusing on a given service, e.g. application, user or protocol, over a given period.
  • It collects performance data such as bandwidth consumption in both absolute values and percentages, average peak usage, etc.
  • It is used to generate charts and alerts if the specified thresholds are exceeded for each service deployed.

     Open url.png See sFlow network traffic monitoring: Operating principle


Challenges in network traffic monitoring

  • Identify the users, applications and protocols with the highest bandwidth consumption in order to optimize the performance of the infrastructure and Internet access costs, and improve the quality of service.
  • Anticipate the risk of incidents and adopt measures to prevent technical network failure.
  • Define bandwidth consumption strategies, implement the required corrective measures and anticipate bandwidth upgrades.
  • Identify the causes of bandwidth bottlenecks rapidly to ensure a return to normal operations as quickly as possible.


  • One service must be deployed for each application, source IP and destination IP to be monitored by sFlow.
  • sFlow flow exports are identified as a combination of the following key fields: source IP address, destination IP address, source port number, destination port number, IP protocol, input logical interface and type of IP service. These are used to collect bandwidth usage statistics.
    • This information must be specified in the Availability and checks tab each time the service template is deployed for a given service, e.g. application, server, router, etc.
    • Any information other than this in this tab is optional. It is used to fine-tune surveillance of bandwidth usage for the monitored service.

Best Practice

  • Link the NetworkAnalysis-sFlow service template and an sFlow agent, i.e. the switch or router exporting sFlow data. 
  • Give a meaningful name to each service linked to the service template so users can identify it easily.


    • Analysis of FTP bandwidth usage ==> FTP_bandwidth  service
    • Analysis of CRM bandwidth usage ==> CRM_bandwidth service
  • Use the NetworkAnalysis-sFlow-TOPList service template in addition to the NetworkAnalysis-sFlow service template to collect the source IP addresses, connections and protocols with the highest bandwidth consumption.

Procedure: How to use the service template

Note: To use services based on the NetworkAnalysis-sFlow service template, specific prerequisites must first be met. The sFlow collector must be installed and configured and sFlow must be enabled on the network interfaces to be monitored.
    Open url.png See the detailed procedure

1. Go to the Web app.

2. Create a new service template.

  • Select Configuration > Services > List in the menu.
  • Click + Add in the Mode: Box tab. 

3. Specify the information below.

General information tab
     NetworkAnalysis-sFlow configuration.png

  • Service template: Select the NetworkAnalysis-sFlow service template.
  • Name: Enter the name of the new service to be created. Its name should correspond to the event to be captured.

Availability and checks tab
     NetworkAnalysis-sFlow - Availability and checks tab.png

  • Collector Storage: IP address of the sFlow collector.
  • Protocol
  • Destination IP: IP address of the network interface monitored by sFlow.
  • Destination port: Listening port of the network interface monitored by sFlow.
  • Source IP
  • Source port
  • Destination network
  • Source network
  • Allocated bandwidth: Value allocated to the bandwidth in the specified output unit.
    • The allocated value will be used in calculating usage ratios.
  • Units: Output unit (Kbps, Mbps, Gbps).
  • Warning threshold: Warning threshold for bandwidth consumption, expressed as a percentage.
  • Critical threshold: Critical threshold for bandwidth consumption, expressed as a percentage.
  • Directory name: Destination folder for network interface flow exports.
  • Absence status: Status indicated if there is no export data.


    • Value 0 indicates that the status is normal (OK)
    • Value 1 indicates that the status is critical (NOK)

4. Click Apply to save the new service template.

Use cases

  • Detect non-business traffic, e.g. YouTube videos, Spotify, etc.
  • Monitor the peak loads of replication services such as backups.
  • Monitor the throughput generated by the email server.
  • Display performance data in both absolute values and percentages, and the average peak usage.
         Performance data example.png
  • Display the overall bandwidth consumption for the LAN network and its breakdown by service, e.g. Web, phone systems, CRM, etc.
         Dashboard example.png
Powered by XWiki © EasyVista 2022