Nephron: derive aggregations for hosts and applications from the conversation aggregation

Description

Flow documents are processed separately to calculate the aggregations for

  • hosts

  • applications

  • conversations

This can be optimized avoiding the repeated processing of flow documents: The conversation key part consists of a host related part and an application related part. Using a suitable representation for the conversation key part, the aggregations for hosts and applications can be derived from the conversations aggregation.

ATM, the conversation key is calculated in OpenNMS by the method ConversationKeyUtils.getConvoKeyAsJsonString(FlowDocument). It is based on the fields

  • location

  • protocol

  • srcAddr

  • dstAddr

  • application

Acceptance / Success Criteria

None

Lucidchart Diagrams

Activity

Stefan Wachter May 17, 2021 at 12:41 PM

The conversation key may be dropped from raw flow protobufs later on because Nephron does no more rely on it.

Stefan Wachter May 17, 2021 at 10:41 AM

Fixed

Details

Assignee

Reporter

HB Grooming Date

HB Backlog Status

Sprint

Fix versions

Priority

PagerDuty

Created February 9, 2021 at 11:22 AM
Updated May 26, 2021 at 12:22 PM
Resolved May 26, 2021 at 12:22 PM

Flag notifications