Set up network flow data monitoring

We recommend using a Docker container to deploy the agent for network flow collection. To use it, you need:

• Docker installed in a Linux host
• Ability to launch new containers via command line
• Network access as defined in the network prerequisites

If you're using Linux to install the agent as a service, you need:

• SSH access to the host
• Access to install/remove applications and services
• Network access as defined in the network prerequisites
• One of these supported operating systems:
  • CentOS 7
  • CentOS 8
  • Debian 12 (Bookworm)
  • Debian 11 (Bullseye)
  • Debian 10 (Buster)
  • RedHat Enterprise Linux 9
  • Ubuntu 20.04 (Focal LTS)
  • Ubuntu 22.04 (Jammy LTS)
  • Ubuntu 23.04 (Lunar)

• Source devices must be configured to send flow data to the host running the network monitoring agent. Here's how to configure network flow export in some devices (this is not an all-inclusive list):

  • NetFlow data
    • Cisco - IOS
    • Cisco - Meraki
    • Cisco - NX-OS
    • Fortinet Fortigate
    • Palo Alto - PAN-OS
  • sFlow data
    • F5 - BIG-IP
  • jFlow data
    • Juniper - Junos

Check the network security prerequisites for network flow.

1. Go to one.newrelic.com > All capabilities > Add more data
2. Scroll down until you see Network and click Network Flows.
3. Follow the steps outlined in the guided installation process. You can use Docker or Linux.

4. Investigate your network flow data in the New Relic network performance monitoring UI.

Before reading about installing the network flow agent manually, consider using our guided install process to avoid errors:

If you follow this manual installation process, support may be unable to assist you if issues arise. If you still wish to proceed, do the following:

1. On a Linux host with Docker installed, download the ktranslate image by running one of the following:

• Docker Hub
  bash

  Copy

  $
  docker pull kentik/ktranslate:v2

• Quay.io
  bash

  Copy

  $
  docker pull quay.io/kentik/ktranslate:v2

2. Copy the snmp-base.yaml file to the local $HOME directory of your Docker user, and discard the container by running

   bash

   Copy

   $
   cd .
   $
   id=$(docker create kentik/ktranslate:v2)
   $
   docker cp $id:/etc/ktranslate/snmp-base.yaml .
   $
   docker rm -v $id

3. Edit the snmp-base.yaml file, and add your network flow devices inside the devices dictionary key with the following structure:

   devices:
    # This key and the corresponding 'device_name'
    # need to be unique for each device
     edge_router:
       device_name: edge_router
       device_ip: 10.10.1.254
       flow_only: true
       # Optional user tags
       user_tags:
         owning_team: net_eng
         environment: production

   Copy

   Important

   If you're already monitoring SNMP data devices that will also send network flows, you'll want to ensure that the value for device_name is identical for both configuration files to ensure the flow telemetry is attributed to the right entity in the New Relic UI.

4. Run ktranslate to listen for network flows by running:

   bash

   Copy

   $
   docker run -d --name ktranslate-syslog --restart unless-stopped --pull=always --net=host \
   >
   -v `pwd`/snmp-base.yaml:/snmp-base.yaml \
   >
   # Replace with your license key
   >
   -e NEW_RELIC_API_KEY=$YOUR_NR_LICENSE_KEY \
   >
   kentik/ktranslate:v2 \
   >
    -snmp /snmp-base.yaml \
   >
    # Replace with your account ID
   >
    -nr_account_id=$YOUR_NR_ACCOUNT_ID \
   >
    # If your organization is located in Europe, add the following flag:
   $
    # -nr_region=EU \
   $
    # If you want to use FedRAMP, add the following flag to use the FedRAMP authorized endpoints:
   $
    # -nr_region=GOV \
   $
    -metrics=jchf \
   >
    -tee_logs=true \
   >
    # Use this field to create a unique value for `tags.container_service` inside of New Relic
   >
    -service_name=$UNIQUE_NAME \
   >
    # This argument disables SNMP collection from the container
   >
    -flow_only=true \
   >
    # This value should match the network flow version you export to this container
   >
    -nf.source=sflow \
   >
    nr1.flow

   Tip

   This command assumes collection of sflow data. If you are collecting other flow types, you should change the suffix in the --name flag for the container and update the -nf.source and -service_name flags as necessary.

5. Investigate your network flow data in the New Relic network performance monitoring UI.