sflow/host-sflow repository overview

⁠What is Host sFlow?

Host sFlow⁠ is an open source agent that exports physical and virtual server performance metrics and network traffic flows using industry standard sFlow⁠ protocol.

⁠How to use this image

docker run -d \
-e "COLLECTOR=10.0.0.70" \
--net=host \
-v /var/run/docker.sock:/var/run/docker.sock:ro \
sflow/host-sflow

Runs Host sFlow agent, streaming sFlow telemetry to standard sFlow port (UDP port 6343) on collector 10.0.0.70.

By default, Docker bridged / overlay networks are monitored by capturing packets on the docker0 and docker_gwbridge bridges.

docker run -d \
-e "COLLECTOR=10.0.0.70" \
-e "NET=host" \
--net=host \
-v /var/run/docker.sock:/var/run/docker.sock:ro \
sflow/host-sflow

Captures packets from physical network adapters on the host in cases where containers use host, macvlan, ipvlan, Calico, etc. networking models. Sampling rate is automatically configured based on link speed.

docker run -d \
-e "COLLECTOR=10.0.0.70" \
-e "NET=^eth" \
--net=host \
-v /var/run/docker.sock:/var/run/docker.sock:ro \
sflow/host-sflow

Captures packets from virtual network adapters matching the regular expression ^eth on a virtual host, i.e. eth0, eth1 etc.

docker service create \
--mode global \
--name host-sflow \
--env "COLLECTOR=10.0.0.70" \
--network host \
--mount type=bind,src=/var/run/docker.sock,dst=/var/run/docker.sock,readonly \
sflow/host-sflow

Monitors all nodes an a Docker Swarm mode cluster.

kubectl apply -f host-sflow.yml

where host-sflow.yml:

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: host-sflow
spec:
  selector:
    matchLabels:
      name: host-sflow
  template:
    metadata:
      labels:
        name: host-sflow
    spec:
      hostNetwork: true
      containers:
      - name: host-sflow
        image: sflow/host-sflow:latest
        env:
          - name: COLLECTOR
            value: "10.0.0.70"
          - name: NET
            value: "host"
        volumeMounts:
          - mountPath: /run/containerd/containerd.sock
            name: containerd-sock
            readOnly: true
      volumes:
        - name: containerd-sock
          hostPath:
            path: /run/containerd/containerd.sock

Monitor all nodes in a Kubernetes cluster.

docker run --rm -p 6343:6343/udp sflow/sflowtool

Run sflow/sflowtool⁠ on the collector host (10.0.0.70) to verify that sFlow is being received. Additional collectors are available on Docker Hub⁠.

docker run -d -p 6343:6343/udp -p 8008:8008 sflow/sflow-rt

Run sflow/sflow-rt⁠ on the collector host to access real-time cluster performance metrics⁠ and network traffic flows⁠ through a REST API. Forwarding using sFlow-RT⁠ describes how to copy sFlow telemetry streams for additional tools.

docker run -d -p 6343:6343/udp -p 8008:8008 sflow/prometheus

Run sflow/prometheus⁠ for an instance of sFlow-RT that includes a Prometheus⁠ exporter. Importing metrics into a Prometheus time series database makes them accessible in Grafana dashboards⁠.

⁠Environment variables

• COLLECTOR Set space separated list of IP addresses to receive sFlow, default 127.0.0.1
• PORT UDP port for sFlow receivers, default 6343
• POLLING Metric export interval (in seconds), default 30
• SAMPLING Packet sampling probability, 1-in-SAMPLING packets, default: 1000
• NET Network devices for packet sampling, docker docker bridges, ovs Open vSwitch, flannel Flannel, host physical adapters, or expr adapters matching regular expression, default docker
• DROPMON Enable dropped packet monitoring (requires Linux 5.4+ kernel), disable or enable, default disable
• DEBUG Print debugging information, none, info, fine, finer, or finest, default none

⁠License

Please read and accept the License Agreement⁠ before downloading this software.