goflow2 VS Performance Co-Pilot

I use goflow2 to do something like this. I don't specifically use syslog itself for this, but mtail to generate the metrics.

I've been using this one: https://github.com/netsampler/goflow2

Take a look at goflow2 which is based on Cloudflare's flow analysis pipeline.

I'm not particularly familiar with netflow formats, but this collector emits Prometheus metrics.

GoFlow2 is a high-performance sFlow/IPFIX/NetFlow collector that gathers network information and serializes it in a common format. This fork of CloudFlare's GoFlow provides horizontal scalability, consistent format and the ability to work with raw samples and build aggregation and custom enrichment. Our thanks for this suggestion goes to SuperQue.

You want something like goflow2.

There's goflow2, which is a fork of CloudFlare's goflow netflow collector.

I'd suggest looking at goflow2 before you write something new.

I personally use goflow2, but my needs are pretty simple.

Set up pcp and send the metrics off-host, so when things go south you don't lose the last few seconds.

Performance Co-Pilot -pcp.io - though. It just works for anything you want. Can get low level stats and export them. It is what Cockpit uses for it's stats too. So if you're gonna use cockpit it's a no-brainer. Even if you're not it's really easy to export the stats to nearly anything and use something like Grafana to keep an eye on it.

Wish these sorts of tweaks were integrated properly into https://pcp.io/