flow_metrics/

FlowMetrics

FlowMetrics是用于接收trident包头统计数据的daemon

名字来源于"zero"的重组，念作rose，即蔷薇

1. 存储的所有数据

db                     rp            measurement   tag
--------------------------------------------------------------------------------------------------------------------
vtap_flow              rp_1m,rp_1s   main          _id,_tid,az_id,direction,host_id,ip,ip_version,l3_device_id,l3_device_type,l3_epc_id,pod_cluster_id,pod_group_id,pod_id,pod_node_id,pod_ns_id,protocol,region_id,subnet_id,capture_network_type_id,agent_id
vtap_flow_port         rp_1m,rp_1s   main          _id,_tid,az_id,direction,host_id,ip,ip_version,l3_device_id,l3_device_type,l3_epc_id,pod_cluster_id,pod_group_id,pod_id,pod_node_id,pod_ns_id,protocol,region_id,server_port,subnet_id,capture_network_type_id,agent_id
vtap_flow_edge         rp_1m,rp_1s   main          _id,_tid,az_id_0,az_id_1,host_id_0,host_id_1,ip_0,ip_1,ip_version,l3_device_id_0,l3_device_id_1,l3_device_type_0,l3_device_type_1,l3_epc_id_0,l3_epc_id_1,pod_cluster_id_0,pod_cluster_id_1,pod_group_id_0,pod_group_id_1,pod_id_0,pod_id_1,pod_node_id_0,pod_node_id_1,pod_ns_id_0,pod_ns_id_1,protocol,region_id_0,region_id_1,subnet_id_0,subnet_id_1,capture_nic,observation_point,capture_network_type_id,agent_id
vtap_flow_edge_port    rp_1m,rp_1s   main          _id,_tid,az_id_0,az_id_1,host_id_0,host_id_1,ip_0,ip_1,ip_version,l3_device_id_0,l3_device_id_1,l3_device_type_0,l3_device_type_1,l3_epc_id_0,l3_epc_id_1,pod_cluster_id_0,pod_cluster_id_1,pod_group_id_0,pod_group_id_1,pod_id_0,pod_id_1,pod_node_id_0,pod_node_id_1,pod_ns_id_0,pod_ns_id_1,protocol,region_id_0,region_id_1,server_port,subnet_id_0,subnet_id_1,capture_nic,observation_point,capture_network_type_id,agent_id

vtap_acl               rp_1m         main          _id,_tid,acl_gid,tag_type,tag_value,agent_id

vtap_wan               rp_1m         main          _id,_tid,az_id,direction,host_id,ip,ip_version,l3_device_id,l3_device_type,l3_epc_id,pod_cluster_id,pod_group_id,pod_id,pod_node_id,pod_ns_id,protocol,region_id,subnet_id,tag_type,tag_value,capture_network_type_id,agent_id
vtap_wan_port          rp_1m         main          _id,_tid,az_id,direction,host_id,ip,ip_version,l3_device_id,l3_device_type,l3_epc_id,pod_cluster_id,pod_group_id,pod_id,pod_node_id,pod_ns_id,protocol,region_id,server_port,subnet_id,tag_type,tag_value,capture_network_type_id,agent_id

vtap_packet            rp_1m,rp_1s   main          _id,_tid,az_id,direction,host_id,ip,ip_version,l3_device_id,l3_device_type,l3_epc_id,pod_cluster_id,pod_group_id,pod_id,pod_node_id,pod_ns_id,region_id,subnet_id,tag_type,tag_value,capture_network_type_id,agent_id
vtap_packet_edge       rp_1m,rp_1s   main          _id,_tid,az_id_0,az_id_1,host_id_0,host_id_1,ip_0,ip_1,ip_version,l3_device_id_0,l3_device_id_1,l3_device_type_0,l3_device_type_1,l3_epc_id_0,l3_epc_id_1,pod_cluster_id_0,pod_cluster_id_1,pod_group_id_0,pod_group_id_1,pod_id_0,pod_id_1,pod_node_id_0,pod_node_id_1,pod_ns_id_0,pod_ns_id_1,region_id_0,region_id_1,subnet_id_0,subnet_id_1,tag_type,tag_value,observation_point,capture_network_type_id,agent_id

注意：所有双端（带edge的数据库）中tx、rx均是以客户端为视角的统计量

2. 统计数据Tag定义

所有的表中，tag均为以下字段的组合，位置相同的字段一定同时出现。

3. vtap_flow

存储1s、1m两种粒度的数据，统计量均以包的timestamp为准。

3.1. 流量

3.2. TCP时延

注意：使用时需要使用sum/count

注意：UDP请求响应时延均值复用art字段

3.3. TCP包异常

3.4. TCP流异常

4. vtap_packet

存储1m粒度的数据，统计量均以包的timestamp为准。

4.1 流量

4.2 关于cast_type

若在kvm X上某个虚拟接口上抓到 smac -> dmac 的包，那么：

• dmac是广播
  • 记录smac对应的虚拟机A及其Region/VPC/Subnet/IP（假设在kvm A上）发送的广播流量
  • 查询虚拟机A的广播流量，可能会得到2倍+的结果，当所有KVM上有2+个相同VLAN的虚接口时
  • 查询KVM A的广播流量，可能会得到2倍+的结果，当所有KVM上有2+个相同VLAN的虚接口时
• dmac是组播
  • 记录smac对应的虚拟机A及其Region/VPC/Subnet/IP（假设在kvm A上）发送的组播流量
  • 查询结果和广播一样
• dmac是未知单播
  • 在虚拟网络（tap_mode=local）环境下，如果smac、dmac均不等于抓包口的MAC （is_l2_end=false），记录为未知单播
• 其它情况：不统计