goflow2 VS nfdump

I use goflow2 to do something like this. I don't specifically use syslog itself for this, but mtail to generate the metrics.

I've been using this one: https://github.com/netsampler/goflow2

Take a look at goflow2 which is based on Cloudflare's flow analysis pipeline.

I'm not particularly familiar with netflow formats, but this collector emits Prometheus metrics.

GoFlow2 is a high-performance sFlow/IPFIX/NetFlow collector that gathers network information and serializes it in a common format. This fork of CloudFlare's GoFlow provides horizontal scalability, consistent format and the ability to work with raw samples and build aggregation and custom enrichment. Our thanks for this suggestion goes to SuperQue.

You want something like goflow2.

There's goflow2, which is a fork of CloudFlare's goflow netflow collector.

I'd suggest looking at goflow2 before you write something new.

I personally use goflow2, but my needs are pretty simple.

https://github.com/phaag/nfdump its an "simple" collector. It is just an CLI tool. If you can utilize the cli it's a monster to analyze the raw data. if you need a fancy gui then this is the wrong collector.

Try the open source nfdump (this should also be a package in Debian/Ubuntu at least). You would configure 'nfcapd' to receive netflow data, then process it with 'nfdump' which is a commandline tool for obtaining statistics on traffic (e.g. top N IPs for bytes/flows, etc).

For the quick look nfdump https://github.com/phaag/nfdump is in use. Since it is a CLI tool, it is not really suitable for managers.