NfSen Alerts. It is essential for a network operator to observe network behaviour and react to unusual behaviour. Automating this process is important to reduce the man power and time network monitoring requires. The NfSen alert interface [NfSenInt] is a good way to automate network monitoring since it provides the ability to trigger alerts when various conditions are met in flow data. An NfSen alert consists of four major elements: Filter: The filter is applied to flow data before the alert conditions are checked. The syntax is same as for Nfdump/NfSen. Alert Condition: This is probably the most important element. The interface for creating alerts allows conditions to be created that are based on flow/packet/byte, sum/rate/average or any statistic value. Up to six conditions can be logically linked with OR or AND. However, while this interface may not be sufficiently powerful to create sophisticated sets of conditions, the plugin interface of NfSen can be used to craft special conditions according to requirements. Alert conditions can be written in backend plugins which are written in Perl. A key subroutine used for this purpose is ―alert_condition‖. If an ―alert_condition‖ subroutine is detected when a backend plugin is being loaded, then a condition for that plugin becomes available in the alert creation dialogue. Any sophisticated anomaly detection or forecasting algorithm can be implemented in this subroutine to craft alert conditions. Trigger Rate: This element takes three inputs: one specifies if an alert will be triggered once or every time the condition is met, one specifies how many times the condition should be met for the trigger to run, one specifies for how many cycles the alert will be blocked after the trigger. If the alert is configured to be triggered once, then it should be manually activated again after it has been triggered. Alert Action: This specifies what action is taken when a trigger is set off. The alert creating interface has three options for an alert action: do nothing, send an email or execute an action specified in one of loaded backend plugins. A key subroutine called ―alert_action‖ is used to specify the alert actions. Any action can be executed as a result of a trigger being set off, for example, logging, mailing or changing firewall configurations etc. Once alerts have been created according to requirements, the NfSen alerts tab displays a list of the created alerts and their states (see the NfSen documentation for a list and definiti...
