Agents
Standard sFlow instrumentation is built into network equipment from over 40 vendors. The sFlow.org web site maintains a list - see Network Equipment.
Switch configurations maintains instructions for configuring sFlow on many of these devices.
| Link Speed | Samping Rate | Polling Interval |
|---|---|---|
| 1G | 1-in-1,000 | 20 seconds |
| 2.5G | 1-in-2,500 | 20 seconds |
| 5G | 1-in-5,000 | 20 seconds |
| 10G | 1-in-10,000 | 20 seconds |
| 25G | 1-in-25,000 | 20 seconds |
| 40G | 1-in-40,000 | 20 seconds |
| 50G | 1-in-50,000 | 20 seconds |
| 100G | 1-in-100,000 | 20 seconds |
| 400G | 1-in-400,000 | 20 seconds |
| 800G | 1-in-800,000 | 20 seconds |
The recommended settings ensure that large flows (defined as consuming 10% of link bandwidth) are detected within approximately 1 second. Counter polling and ingress packet sampling should be enabled on every port on every device for complete visibility.
The Host sFlow agent exports standard metrics from AIX, FreeBSD, Linux, Solaris, and Windows hosts; Docker containers; Hyper-V, KVM/libvirt, and Xen hypervisors. The Host sFlow agent can also be used to relay custom sFlow-RT metrics. Host sFlow agent extensions are used to monitor Apache and NGINX web servers, HAProxy, Tomcat, Java virtual machines, and Memcached servers.
Host, Docker, Swarm and Kubernetes monitoring describes how to use the sflow/host-sflow image to deploy sFlow agents in container environments.