# Collector Configuration Options

## Overview

Concurrency
Filtering Flows
Exporters
Implement Your Own Exporter as a Plugin

## Concurrency

By default when running on a host with multiple cores, the collector takes advantage of by creating a separate server process per core. This parallelizes IPFX processing. This configuration can be tuned using the "multiprocess" dictionary inside of the main collector config file.

To disable multiprocessing (force a single process):

    {

        "multiprocess":

            {"enabled": false}

    }

To force 2 server processes:

    {

        "multiprocess":

            {

                "enabled": true,

                "numProcesses": 2

            }

    }

## Filtering Flows

Collector supports three optional flow filtering modes- inclusion mode (whitelist), exclusion mode (blacklist), and hybrid. Filtering is defined in a separate JSON policy file. The policy file path could be specified when starting the collector. By default, the collector will look for policy stored in this file:

    /etc/acnvmfilters.conf

If no policy exists, filtering is disabled and all flows will be processed and exported. The three filtering modes operates as follows:

- Include Only (whitelist) - By default, a flow is dropped unless it matches an include rule.
- Exclude Only (blacklist) - By default, a flow is collected unless it matches an exclude rule.
- Include + Exclude (hybrid) - By default, a flow is dropped unless it matches an include rule AND it does not match an exclude rule.

Each rule is specified as a JSON dictionary, with each key/value pair specifying a match criteria on a flow field (whose name matches the key). Suffix wildcards are supported for string field types and is denoted by a *.

Sample: Exclude all DNS flows:

    {

      "rules":

        {

            "exclude":

            [

                {"dp": 53, "pr": 17}

            ]

        }

    }

Sample: Exclude flows to certain DNS servers:

    {

      "rules":

        {

            "exclude":

            [

                {"dp": 53, "pr": 17, "da": "1.2.*"},

                {"dp": 53, "pr": 17, "da": "8.8.8.8"}

            ]

        }

    }

Sample- Only collect flows from Angry Birds (Android app), but ignore DNS flows:

    {

      "rules":

        {

            "include":

            [

              {"pname": "com.rovio.angrybirds"}

            ],

            "exclude":

            [

                {"dp": 53, "pr": 17, "da": "1.2.*"},

                {"dp": 53, "pr": 17, "da": "8.8.8.8"}

            ]

        }

    }

## Additional Exporters

The collector exporter currently supports Splunk (syslog). There is also limited support for Kafka. To request additional support, please contact: nvzflow@cisco.com

Export behavior can be configured in the main configuration file.

Sample Splunk (syslog) Export Configuration

    {

      "exporter": {

            "type": "syslog",

            "syslog_server": "localhost",

            "flow_port": 20519,

            "endpoint_port": 20520,

            "interface_port": 20521

        }

    }

Sample Kafka Export Configuration

    {

      "exporter": {

            "type": "kafka",

            "bootstra_server": "localhost:9092",

            "flow_port": "flow",

            "endpoint_port": "endpoint",

            "interface_port": "interface"

        }

    }

## Implementing Your Own Exporter as a Plugin

The collector's export capability can be extended using native C++ code by building a shared library against the plugin API. The SDK bundle (including headers and sample) is located in the Splunk app bundle in addon directory: CiscoNVM/appserver/addon. For questions, please contact: please contact: nvzflow@cisco.com

To use your custom plugin, a special configuration is required in the main collector config:

    {

        "exporter": {

            "type": "plugin"

        }

    }