---
name: "flow-rpt2rrd"
section: "1"
platform: "linux"
package: "flow-tools"
version: "1:0.68-12.5+b3"
release: "Debian 10 (Buster)"
platforms: ["linux"]
url: "https://new.carta.tech/flow-rpt2rrd"
---

# flow-rpt2rrd(1)

Convert flow-report CSV output to RRDtool format.

## NAME

**flow-rpt2rrd** — Convert flow-report CSV output to RRDtool format.

## SYNOPSIS

**flow-rpt2rrd** \[-nv\]  \[-d *debug\_level*\]  \[-k *keys*\]  \[-K *keys\_file*\]  \[-f *fields*\]  \[-p *rrd\_path*\]  \[-P *rrd\_postfix*\]  \[-r *rrd\_storage*\]

## DESCRIPTION

The **flow-rpt2rrd** utility processes the CSV output of flow-report into RRDtool format.  The aggregates for a key are each stored as a DS in RRD filename {rrd\_path,"/",key,rrd\_postfix,".rrd"}. By default a DS is created for flows, octets, and packets.  The key must be specified, for example an ip-port report could use smtp,nntp,ssh,telnet as the keys which would create a separate RRD for each key.

## OPTIONS

- \-d *debug\_level*

  Set debug level to debug\_level (debugging code)

- \-h

  Help.

- \-k *keys*\|*html*

  Comma separated list of key values.  If the report has symbols then the key must be the symbol, ie smtp not 25.  The totals\_\* lines may be used if they are enabled in the report.  There is no default,  keys must be specified with -k or -K.

- \-K *keys\_file*

  Load keys from *keys\_file*.  See -k.

- \-f

  Comma separated list of columns to store.  Each column maps to a DS in the RRD.  Defaults to flows,octets,packets

- \-n

  Enable symbol table lookups.  For example TCP port 25 = smtp.  This will result in RRD file names with the symbolic names if symbol lookups were not enabled in the report.

- \-p *rrd\_path*

  Set path to RRD files.  Defaults to ".".

- \-P *rrd\_postfix*

  Set RRD file name postfix.  Defaults to "".

- \-r *rrd\_storage*

  Set RRD storage for 5 minute, 30 minute, 2 hour, and 1 day databases.  List items are : seperated.  Defaults to 600:600:600:732.

- \-v

  Enable verbose output.

## EXAMPLES

```
The following example shows the combined use of flow-nfilter (inline),
flow-report, and flow-rpt2rrd to create an RRD depicting traffic
from clmbo-r4 to AS 10796 and 6478 for 2004-11-08.  rrdtool graph is
then used to create a .png.
#!/bin/sh
cat << EOF>report.cfg
include-filter nfilter.cfg
stat-report CLMBO-R4-TO-INTERNET-BY-DESTINATION-AS
  type destination-as
  filter CLMBO-R4-INTERNET-OUT
  scale 100
  output
    options +header,+xheader
    fields -duration
stat-definition 5min-summaries
  report CLMBO-R4-TO-INTERNET-BY-DESTINATION-AS
EOF
cat << EOF>nfilter.cfg
# ifMIB.ifMIBObjects.ifXTable.ifXEntry.ifName.46 = so-0/0/0.0
filter-primitive CLMBO-R4-INTERNET
  type ifindex
  permit 46
# Match on traffic to the Internet
filter-definition CLMBO-R4-INTERNET-OUT
  match output-interface CLMBO-R4-INTERNET
EOF
mkdir rrds
# 5 minute flow files from flow-capture are here
FLOW_DATA=/flows/clmbo-r4/2004-11-08/
# for each 5 minute flow,aggregate with flow-report then store to RRD
for name in $FLOW_DATA/*; do
  echo working...$name
  flow-report -s report.cfg -S5min-summaries < $name | flow-rpt2rrd -k10796,6478  -p rrds
done
# first flow - 0:1:23 11/8/2004
START=1099890083
# last flow - 0:1:25 11/9/2004
END=1099976485
rrdtool graph CLMBO-R4-TO-INTERNET.png --start $START --end $END         --vertical-label "Bits/Second" --title="CLMBO-R4 TO INTERNET BY AS"         DEF:AS10796in=rrds/10796.rrd:octets:AVERAGE         DEF:AS6478in=rrds/6478.rrd:octets:AVERAGE         CDEF:b_AS10796in=AS10796in,8,*         CDEF:b_AS6478in=AS6478in,8,*         LINE1:b_AS10796in#FF0000:AS10796-in         LINE1:b_AS6478in#555555:AS6478-in .fi
```

## BUGS

Hard coded to expect 5 minute flow file intervals.  Does not properly parse flow-report time-series output.

## AUTHOR

Mark Fullmer maf@splintered.net

## SEE ALSO

[**flow-tools**(1)](/flow-tools/1.md)