ElastiFlow VS Munin

As a matter of fact, I played with the now deprecated Elastiflow, however I couldn't get my head around managing ELK, scrapped it pretty quickly, and Netflow did not reach the meaningful stage at that time. OpenNMS looks pretty massive that I can't run it at the moment. Thanks for suggestion though.

One thing I ran for a while was security onion and utilized port mirroring to mirror the uplink port from my primary switch to my LAN on my router, so I was catching anything coming into/out of my network destined for internet. I've also used ElastiFlow ( https://github.com/robcowart/elastiflow ) which is absolutely phenomenal and awesome, I did the same and it provides some great data. You could also leverage IntelOwl ( https://github.com/intelowlproject/IntelOwl ) , one thing I have added to all my VMs is a OSSEC agent, Wazuh to be specific which is free ( https://github.com/wazuh/wazuh ) and while I am not using it to its full potential such as monitoring file deletions/modifications etc it is a powerful tool.

I'd recommend taking a look at Elastiflow (link is to the legacy version, I haven't used the pay structured tier version that replaced it) as a flow collector. Do it in a docker container, dump netflow to it, and use a sample rate that doesn't fill your collector box with flow packets after a single day. Depends on your traffic rates. We use 1 out of 250 for our rate.

https://github.com/robcowart/elastiflow/issues/201 https://github.com/robcowart/elastiflow/issues/52

Where as the newer version is (https://github.com/robcowart/elastiflow/) is called:

I rediscovered Munin. To my surprise it is written entirely in Perl. I remember Munin from years ago... it still seems healty and maintained and lies ready on your Deb-Repositories. So I followed the Easy Install Guide... which really is easy, but fails to mention that you need to install your own HTTP-Server to serve the HTML-reports.

A bit of background, which may make understanding my choices in this lib easier: Munin is a resource monitoring tool using rrdtool, usually run in a Server/Client Setup. The client accepts plugins which are just executables in a directory. Usually written in a scripting language, but it actually doesn't matter. Data is fetched every 5 minutes, plugins are first run with a config argument to spit out a munin graph config, followed by a run without arguments to present data. To support higher resolutions than just "every 5 minutes", graph config can contain config to tell munin one collects it every second. Then the fetching part needs to run as a daemon, writing a cache somewhere which gets output when munin wants the data.

Munin plugins and management script for monitoring various Pi-hole® statistics.

When you do not have enough power you would get errors because looking up the plots would simply fail. Sounds more that there is one disk which is slower. I had one 2TB external usb which was really slow and the latency of lookups was through the roof. Are you on linux ? Then install munin-monitoring.org it shows latency of the disks out of the box.

what os ? on linux install https://munin-monitoring.org/ it will give you disk latency information.

I'd say give Munin a try.

Munin plugins for monitoring Pi-hole®. Transforms a server into a powerful monitoring platform, as simple as one, two, three, ...four.