The Top N page displays top clients, servers and connections.
- How do I navigate the network hierarchy?
- How do I select the information displayed on the chart?
- How do I display information on items in the chart?
- How do I create a filter to select specific operations?
- How do I create a custom chart?
The Filter bar at the top of the screen provides a way to navigate through the network hierarchy (see File>Configure to see how to group network devices). At the top level, a list of Zones is shown, once you have selected a zone, the view will drill down to only show information from the selected zone, and a list of Groups will appear. Select a group and the view will drill down to only show the information from the selected group and a list of Agents will appear. Finally if you select an agent, the lists Hosts being monitored by the agent will be displayed. Click on the links at any level in the path and you will move back up the tree to that level.
Click on the Hosts button to go to see host performance trends (see Sentinel:Hosts>Trend). Click on the Explore button to see long term trends (see Sentinel:Report>Explore). If a single agent has been selected an Agent Details button will appear. Click on the button to see detailed information about the agent (see Sentinel:Search>Agent/Interface). Finally, if a single server instance has been selected a Host Details button will applear. Click on the button to see detailed information about the host (see Sentinel:Search>Host).
The following Filter options are available:
- Service selects the service to monitor.
- Chart selects the data to be displayed, chart options depend on the selected service.
- Units specifies the scaling used on the vertical axis of the chart.
- Date select a date, clicking on today's date will track most recent data.
- Time selects the hour at the start of the Interval, Now will track most recent data.
- Interval select the number of minutes of data to display. The interval starts from the specified Time, or if Time is set to Now displays an interval going back from the current minute. Setting a large Interval will cause the bars to change from 1 minute per bar to 2 or more minutes per bar, reducing the number of bars so that they are wide enough to display.
- Where is used for custom filtering of the flows (see How do I create a filter to select specific flows?).
By default, the legend in a bar chart will reflect the top contributors to the latest bar. Click on any bar to see the top contributors during that minute (and any traffic they may have generated at other times). Click on the last bar to restore the default behavior of displaying contributors to the most recent minute. The gray part each bar represents traffic not attributable to the sources in the legend.
Click on links in the legend to perform actions on that item. The color boxes are also clickable, representing the entire row in the table. Clicking on an item opens a dialog box with buttons for each action.
One or more of the following actions may be available:
- Filter Create a Where filter to select operations containing the selected item.
- Exclude Create a Where filter to exclude operations containing the selected item.
- Search Go to the search page to find out additional information on the selected item. Click on the Traffic tab to return to your chart.
The simplest way to filter traffic is to click on the legend item and create filters based on the selected item (see How do I display information on items in the chart?). For more complex filtering tasks, the following instruction describe how to manually enter a filter:
The Where box is used to filter traffic queries so that only selected traffic is shown. A filter expression can be entered directly into the input box. Clicking on the OK button applies the filter. Clicking on the Clear button will remove the filter.
An easier way to construct filters is to click on the Edit button to display additional inputs used to construct the filter expression. The first input consists of a selection box containing attributes that can be compared, a selection box containing comparison operators and an input area to specify that values to be compared to the selected attribute. Clicking the Add button appends the comparison to the current filter. There are also boolean operator buttons (& and |) and bracket buttons that can be used to combine comparison expressions to form more complex filters. The filter builder only enables buttons and inputs when they are allowed in the filter expression that is being constructed. Once the desired filter has been constructed, click on the OK button to apply it.
Note: If you just want to filter on a Host or Protocol then it is easier to set the Host and Protocol options in the Filter bar, rather than constructing a Where filter.
A basic filter expression consists of the name of an attribute, an operator and a set of comma separated values. The allowed operators are:
- = equals
- != not equals
- ~ matches a reqular expression
- !~ does not match a regular expression
Expressions can be combined using brackets and the boolean operators:
- & boolean AND
- | boolean OR
The following examples illustrate typical where filters:
- ipsource = 10.1.1.23
- ipdestination != 10.0.0.0/24,10.0.1.0/24
- serverport = TCP:80,TCP:81,TCP:8080-8088
- sourcezone ~ research.*
- ipsource = 10.0.0.1 & ipdestination = 10.0.0.2
- ipsource = 10.0.0.1 & (sourceport = TCP:80 | destinationport = TCP:80)
- sourcezone = EXTERNAL | destinationzone = EXTERNAL
Note: The special zone EXTERNAL refers to addresses that aren't contained in any of the CIDRs specified using File > Configure.
WARNING Care should be taken if a value in a filter expression contains any of the following special characters: (, ), &, |, !, =, ~, ",', \, comma or space. If the value contains any of these characters then the whole value string can be enclosed in single or double quotes, or the special characters can be individually escaped with a \. The following examples show different ways of using the value "Research & Development" in filters:
- serverzone = "Research & Development", Sales
- clientzone = 'Research & Development'
- sourcezone = Research\ \&\ Development
- serverpath = ">>Research & Development>Data Center"
Note: Special characters typically occur because they are used in Zone or Group names when configuring Traffic Sentinel (see File>Configure). Care should be taken when filtering on zone, group or path attributes.
The charts at the bottom of the list, labelled Custom N by default, are configurable by each user. When a customizeable chart is selected, an Edit Columns button will appear immediately to the right of the chart name. Click on the Edit Columns button to reveal additional options. Each operation key will appear as an option button allowing the keys to be changed. Setting a key to None will remove it. An additional option button allows keys to be added. The Label field allows the chart to be named. Click on the Submit button to commit the changes.
Note:The number of custom charts can be configured using the Sentinel:Home>Settings form.