Uploaded image for project: 'OpenNMS'
  1. OpenNMS
  2. NMS-10957

Netflow - Minion/Sentinel generate a "message" on inbound flow timestamp skewed from local UTC clock more than X

    XMLWordPrintable

    Details

    • Type: Enhancement
    • Status: Closed (View Workflow)
    • Priority: Minor
    • Resolution: Duplicate
    • Affects Version/s: 22.0.0
    • Fix Version/s: None
    • Component/s: None
    • Security Level: Default (Default Security Scheme)
    • Labels:

      Description

      As the Minion/Sentinel will always see the live inbound netflow streams, have them generate a "message" when the timestamp in the header is skewed by more than X, where X is a configurableĀ second value (recommend 15 minute or 900 second default value)

      Because logging by UTC timestamp in source determines which ES index will be used, it is important to minimize skew as well as help system operators look into devices that may be out of sync. This will require Minion/Sentinel hosts to be time sync'd to a valid network clock to be able to detect skew.

        Attachments

          Issue Links

            Activity

              People

              Assignee:
              Unassigned Unassigned
              Reporter:
              sean Sean Torres
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Dates

                Created:
                Updated:
                Resolved: