Director CLI

When logged into Director via SSH or serial console as the admin user, you have access to the director command. This command, when executed without any other parameters, launches the Director CLI. You can also invoke Director CLI commands from the terminal directly be adding them as parameters (e.g. director reload config will have Director reload its current running configuration), which will only run the entered command but not launch the CLI.

While in the CLI, it offers tab autocompletion and the ability to enter ? at any time for more details on available commands. It will also provide a bottom status bar showing the current time, the latest connection to rWeb status, whether or not the core Director program is running with a good configuration, and if there is a license issue.

The primary usage of the CLI (outside of initial setup and reloading configuration) is to view the current operational state of Director and any active actions. The commands starting with show are the most useful for this purpose:

The show config command branch can be used to see the applicable configuration on a per-host basis, or by Zone.
The show actions command branch can be used to get a list or a summary of all currently active actions, or drill down into a specific action.
The show sample command branch can be used to check current flow sampling behavior.
The traffic and traffic-current command branches can be used to perform traffic analysis on the flow samples you've received so far.

Sample

When first installing Director, or to check system behavior after networking changes like adding additional upstream routers to monitor, it can be useful to observe whether or not flow samples are being received properly by Director. Once you have configured the appropriate flow monitoring ports and configured network devices to send samples to Director, you can check to see if you are correctly receiving samples. You can do this by checking if your sample counts are increasing and if a sampling rate has been correctly calculated:

# show sample counts
Sample Source IP |    Type    | Count 
172.29.33.4      | sflow      | 4659  
172.30.254.101   | netflow_v9 | 595764

# show sample rates
        Sample Source IP          |  Type   | Sample Rate (1 in N Packets)
172.29.33.4, sub-agent 100000_0_3 | sflow   | 400                         
172.30.254.101                    | netflow | 1024  

In a correctly configured system with live network traffic, sample counts should be increasing over time. The sample counts will get reset on reboot or configuration changes, such as by issuing a reload config command.

By default the counts and rates commands will show all available sample data, but you can also filter by type (use tab or '?' to see available options).

info

counts can discriminate between netflow_v5 and netflow_v9 packets received, but the rates calculation is done for the source as a whole under netflow.

Traffic

The top level show traffic command has many useful options for analyzing received flow samples. By default, Director stores a week's worth of data that can be fully examined by this command. Most of the time, this historical data will be used to check that your workflow triggers are set at appropriate levels for your configured groups and zones. Here is the help listing for show traffic (triggered by hitting '?'.md):

# show traffic
for: Limit data to query
by: Group results by
per: Compute results per
top: How many rows to return
all: All traffic types
tcp: TCP Traffic
tcp-syn: TCP-Syn Traffic
udp: UDP Traffic
icmp: ICMP Traffic
fragmented: Fragmented Traffic
bits: in bits per second (bps)
packets: in packets per second (pps)
incoming: Inbound traffic
outgoing: Outbound traffic
peak: Peak rate
average: Average rate
95pct: 95th percentile rate
from: Traffic after timestamp
to: Traffic before timestamp
<enter>: Query traffic

There are many options and combinations of flags that can be set, which will query the database of samples after hitting 'enter'. The default query will check for the maximum observed incoming bit rate:

# show traffic
Querying max(bits_incoming) for all by total calculated per row
Rows processed:  100.0% [==================================================================>] 92510747/92510747 eta [00:00]
Top 10 results:
Max(bits_incoming)
238.1 Mbps    

While executing a query, it will show how many rows are being processed and how long it estimates the query to take. Queries can be cancelled by hitting 'x' (a prompt will be shown for this, though it may only be obvious on queries taking longer than a second or two).

Traffic-Current

The top level show traffic-current command has many useful options for analyzing received flow samples at a particular point in time (usually as of the moment you run the command). By default, Director stores a week's worth of data that can be used by this command to check traffic conditions at any point during that week. Here is the help listing for show traffic-current (triggered by hitting '?'.md):

# show traffic-current
for: Limit data to query
by: Group results by
top: How many rows to return
all: All traffic types
tcp: TCP Traffic
tcp-syn: TCP-Syn Traffic
udp: UDP Traffic
icmp: ICMP Traffic
fragmented: Fragmented Traffic
bits: in bits per second (bps)
packets: in packets per second (pps)
incoming: Inbound traffic
outgoing: Outbound traffic
at: Traffic at timestamp
<enter>: Query traffic

There are many options and combinations of flags that can be set, which will query the database of samples after hitting 'enter'. The default query will check for the current observed incoming bit rate:

# show traffic-current
Querying Current bits_incoming for all by total
Rows processed:  100.0% [====================================================================>] 4383003/4383003 eta [00:00]
Top 10 results:
Sum(bits_incoming)
206.3 Mbps  

Sample​

Traffic​

Traffic-Current​

Sample

Traffic

Traffic-Current