DX Unified Infrastructure Management

Hello guys,

I'm trying to find some information about how to integrate (If posible) CA Network Flow Analysis with Splunk but i could'nt find anything. Can you please tell me where i can get this documentation?.

Thanks.

Good luck.  We’ve certainly tried.   Ideally, you’d be able to use an API, but that’s not available for NFA.    If you find anything,  please post.  Keep in mind, the volume could be huge…

There is no official supported integration between NFA and Splunk.

As for the API's customers have been looking for API's in NFA for a while, there is an Idea here, please upvote: API for NFA

Thanks you.

i dont know if i should create a new topic or not, if im wrong please tell me.

Is there any way to pull data from harvester database?

As i said, i need this data to work on Splunk and this seems to be the only way.

** I was reading this article http://www.ca.com/us/support/ca-support-online/product-content/knowledgebase-articles/tec1853184.aspx 

Thanks you in advice

Data is stored on the Harvester, but not in the 'harvester' database.

1 minute Data is stored in the \Netflow\datafiles\ReaperArchive\ directory and 15 minute data is stored in the \Netflow\datafiles\ReaperArchive15\  directories.  Raw Flow Forensics data is stored in the \Netflow\datafiles\HarvesterArchive\ directory.  All of this datais accessed by the Custom Mysql Storage Engine that runs on port 3307.  There are three databases in this 3307 instance of mysql, archive and archive15, which is for 1 min and 15 minute data respectively, and the nsas database which has the flow forensics data. 

The nsas database is probably easiest to query, but it will only have data for the last 24 hours.  There is only 1 table, ahtflows. 

To login to the 3307 instance of mysql you run: "mysql -P3307 nsas".

Once in there you can run a query like below to see how the data looks in this table and which columns are available:

select * from ahtflows limit 5;

It can be a bit tricky to query the other databases as most will need specific where clauses and if your query is poorly formed it can cause the NQMysql service to either crash or hang.  The best way to see how the db's are queries is to setup Mysql Query logging on the Harvester, then run a report that you would want to replicate via your own mysql queries, and then stop the query logging, and review the output log.  The log will show all queries run during the time frame that logging was enabled so it should capture the queries used by the NFA software to pull the report you ran.  You can use this as a template for other queries.

To setup query logging follow the steps below:

1. Login to the 3307 instance of mysql by running:

mysql -P3307

2. Then run the following to set the name of the log file:

SET GLOBAL general_log_file='query.log';

3. Then get a report page ready to refresh.

4. Then enable query logging by running:

set global general_log = 'ON';

5. Refresh the report page, so the data is pulled again.

6. Stop the query logging by running:

SET GLOBAL general_log = 'OFF';

7. Review the log file in the \Netflow\data\ directory.

Well…. This is certainly interesting.  Thanks!

Can you say DB Connect?

I will try this.

Thanks you very much.