Custom Metrics

Scripting languages describes how the generic sFlow Application Structures can be parameterized as JSON objects and sent to the local Host sFlow daemon (hsflowd) for transport to a remote sFlow collector.  The application structures model the semantics of multi-tiered networked applications, allowing analytics applications to model communication between application tiers.

hsflowd 1.28.3 adds rtmetric and rtflow messages to allow arbitrary metric and event messages to be transported in the sFlow stream. To enable receipt of JSON UDP messages, add "jsonPort=36343" to /etc/hsflowd.conf and restart hsflowd. If it's easier to write to a file then you can create a named pipe with "mknod <path> p" and add "jsonFIFO=<path>" to /etc/hsflowd.conf

Here are some example messages.

{
  "rtmetric": {
    "datasource": "my-app",
    "my_metric1": { "type": "counter32", "value": 1334         },
    "my_metric2": { "type": "gauge32",   "value": 5            },
    "my_metric3": { "type": "string",    "value": "helloworld" }
  }
}

The rtmetric message represents a set of related counters, gauges, and/or strings.

{
  "rtflow": {
    "datasource": "my-app",
    "sampling_rate": 1,
    "my_field1": { "type": "int32",   "value": 777            },
    "my_field2": { "type": "string",  "value": "helloworld"   },
    "my_field3": { "type": "mac",     "value": "020304050607" },
    "my_field4": { "type": "ip",      "value": "10.1.2.3"     }
  }
}

The rtflow message represents the attributes and values associated with an event. High frequency events can be randomly sampled and the sampling rate setting is used to indicate the sampling rate (e.g. a sampling_rate of 100 indicates that 1-in-100 events are being randomly sampled).

Notes:

• The datasource must start with a letter and be <= 64 bytes
• The metric/field names can only have letters, digits, "-" and "_" and be <= 64 bytes long
• rtmetric types can be "string", "counter32", "counter64", "gauge32", "gauge64", "gaugeFloat" or "gaugeDouble"
• rtflow types can be "string", "mac", "ip", ip6", "int32", "int64", "float" or "double"

The Python script, rtmetric.py, is a command line utility for sending rtmetric messages, e.g.

./rtmetric.py -d my_app -n my_metric1 -t gauge32 -v 3 -n my_metric2 -t counter32 -v 1234

You can verify receipt of the metrics by checking the sFlow-RT /metrics/html page.

The Python script, rtflow.py, is a command line utility for generating rtflow messages, e.g.

./rtflow.py -d my_app -n my_field1 -t string -v hello -n my_field2 -t int32 -v 10

You can verify receipt of the flow records by checking the sFlow-RT /flowkeys/html page.

In bash you can simply output to /dev/udp/localhost/36343, for example, the following script exports the number of users logged into the host:

#!/bin/bash
users=$(users | wc -w)
msg='{"rtmetric":{"datasource":"host","users":{"type":"gauge32","value":'$users'}}}'
echo $msg > /dev/udp/localhost/36343

Run the script every minute using cron to continuously monitor users.