VyOS NetFlow and EventLog configuration
VyOS is an open-source network operating system based on Debian Linux, that came from the development version of Vyatta routing software. While there is both an open-source and paid version of VyOS, here we will focus on the open-source, nightly build solution.
VyOS provides a free routing platform that competes directly with other commercially available solutions from well-known network providers. Because VyOS is run on standard amd64 and other architectures, we can use it in different scenarios, with or without virtualization.
VyOS is a CLI-based solution. Although there are aftermarket GUI options since the system has API support, we will focus on CLI and keep it simple. If you need additional information or instruction, know that VyOS User Guide
is great and extensive, so feel free to peruse per your needs.
NetFlow configuration is really easy. You only need to set up the NetFlow server location, interfaces to collect from ... and you're done! For example:
set system flow-accounting disable-imt
set system flow-accounting netflow version 9
set system flow-accounting netflow server 192.168.8.182 port 2055
set system flow-accounting interface eth0
set system flow-accounting interface eth1
An additional thing that can be disabled is locally collected NetFlow data via the disable-imt command, though you would lose the output of the show flow-accounting commands. And that's all! You should now be able to see the NetFlow data in the Netflow collector.
To make interfaces discoverable, we need to enable SNMP on VyOS:
set service snmp community routers authorization ro
set service snmp community routers network 192.0.2.0/24
If you think NetFlow configuration was easy, check out Syslog configuration:
set system syslog host 192.168.8.182 facility all level all
You can set up facility and level options differently by following the documentation. Also, when entering commands in VyOS don't forget to commit and save, to apply the commands right away.