TNPFA 4.1.1 Installation and User Guide - e IBM Tivoli Composite ...

1.1 Reporting
Traffic usage reports are provided for bit, packet, and flow rates in tables, pie charts, and interactive
graphs. The reports contain information about single or combinations of the following traffic aspects:
• Applications (for example, mail, http, backup, printer, Lotus Notes)
• Hosts and servers
• Domains defined by lists of subnets, autonomous systems, or flow filters
• Individual end-to-end flows
• Traffic types (for example, unicast, broadcast, multicast, IPv4/IPv6, ICMP)
• Service types (for example, IETF DiffServ)
• Protocols (for example, TCP, UDP, ICMP)
• TCP/UDP ports and services (for example, DFS, DNS, SSH, telnet, POP3, SMTP)
• Flow-information exporters and interfaces
Total traffic volumes are reported by direction (sent or received) for all configured aspects. Reports are
automatically generated for selected periods, in PDF format. You can use Tivoli Netcool Performance
Flow Analyzer to generate customised reports in HTML, JSON, and as textual output, using the flow
analyzer application programming interface (API), see Appendix A. Tivoli Netcool Performance Flow
Analyzer supports domain views including 95th-percentile computation per direction, see Appendix
B.
User-defined combinations of traffic aspect components provide better understanding of end-to-end
traffic flows. An example of a user-defined aspect is a quality-of-service breakdown by application and
source or destination autonomous system.
1.2 Aggregation database
Traffic flow profiling requires advanced database technology to handle high flow volumes in large
enterprise and service provider infrastructures. Tivoli Netcool Performance Flow Analyzer uses an
aggregation database (ADB) that is specifically designed for efficient memory and storage footprints.
The ADB provides a mechanism for efficient incremental storage of primary traffic data values which
are associated with time intervals. The database stores data values in groups of circular arrays of
period-dependent resolution. Therefore, the database is able to handle large flow data sets with fast
access times and limited storage.
The ADB uses lower resolution for arrays that cover longer time periods. Additionally, the design of
the ADB reduces memory-to-disk synchronization and accelerates data import and export. Users can
quickly change their viewpoint when looking at traffic flows. Because data is represented in the ADB
for multiple viewpoints, flow files do not have to be reanalyzed or newly indexed.
Array grouping in the ADB optimizes the creation of sorted views of related parameters. This feature
is of great importance to efficiently display sorted lists of top protocols, top hosts, top flows, and so on.
The ADB supports period durations of hour, day, week, month, quarter, and year.
6 IBM Tivoli Netcool Performance Flow Analyzer: Installation and User Guide