| 1 | # NetFlow/IPFIX/sFlow plugin configuration. |
| 2 | # |
| 3 | # This file is loaded by netflow-plugin when running under Netdata from: |
| 4 | # - /etc/netdata/netflow.yaml (user config, preferred) |
| 5 | # - /usr/lib/netdata/conf.d/netflow.yaml (stock fallback) |
| 6 | # |
| 7 | # If listener/protocol/journal values are omitted here, they follow plugin defaults. |
| 8 | # |
| 9 | # If enrichment.geoip paths are omitted, netflow-plugin auto-detects MMDB files from: |
| 10 | # - NETDATA_CACHE_DIR/topology-ip-intel |
| 11 | # - NETDATA_STOCK_DATA_DIR/topology-ip-intel |
| 12 | |
| 13 | # Global plugin switch for netflow-plugin itself. |
| 14 | enabled: true |
| 15 | |
| 16 | listener: |
| 17 | # UDP socket for NetFlow/IPFIX/sFlow exporters. |
| 18 | listen: "0.0.0.0:2055" |
| 19 | max_packet_size: 9216 |
| 20 | sync_every_entries: 1024 |
| 21 | sync_interval: 1s |
| 22 | |
| 23 | protocols: |
| 24 | v5: true |
| 25 | v7: true |
| 26 | v9: true |
| 27 | ipfix: true |
| 28 | sflow: true |
| 29 | # one of: none, srv6, vxlan |
| 30 | decapsulation_mode: none |
| 31 | # one of: input, netflow_packet, netflow_first_switched |
| 32 | timestamp_source: input |
| 33 | |
| 34 | journal: |
| 35 | # Relative paths are resolved against NETDATA_CACHE_DIR. |
| 36 | # With the default Netdata cache dir this becomes /var/cache/netdata/flows. |
| 37 | journal_dir: flows |
| 38 | |
| 39 | # Per-tier retention. Each tier has its own size_of_journal_files (hard |
| 40 | # cap; minimum 100MB; null disables size-based retention) and |
| 41 | # duration_of_journal_files (time cap; null disables time-based |
| 42 | # retention). Validation requires at least one positive limit per tier. |
| 43 | # Internal rotation size derives from size_of_journal_files: |
| 44 | # clamp(size_of_journal_files / 20, 5MB, 200MB). When size is null, |
| 45 | # internal rotation defaults to 100MB and retention is controlled only |
| 46 | # by duration. |
| 47 | tiers: |
| 48 | raw: |
| 49 | size_of_journal_files: 10GB |
| 50 | duration_of_journal_files: 7d |
| 51 | minute_1: |
| 52 | size_of_journal_files: 10GB |
| 53 | duration_of_journal_files: 7d |
| 54 | minute_5: |
| 55 | size_of_journal_files: 10GB |
| 56 | duration_of_journal_files: 7d |
| 57 | hour_1: |
| 58 | size_of_journal_files: 10GB |
| 59 | duration_of_journal_files: 7d |
| 60 | |
| 61 | # Cap on the number of distinct group keys a single aggregation query |
| 62 | # can build before extra groups are folded into a synthetic |
| 63 | # __overflow__ bucket. Protects the worker from accidentally wide |
| 64 | # group-by combinations exhausting memory. |
| 65 | query_max_groups: 50000 |
| 66 | |
| 67 | # Optional advanced enrichment modules. |
| 68 | # Keep disabled unless explicitly configured. |
| 69 | enrichment: |
| 70 | routing_dynamic: |
| 71 | bmp: |
| 72 | enabled: false |
| 73 | bioris: |
| 74 | enabled: false |