diff --git a/docs/Collecting Metrics/Collectors/Hardware and Sensors/Hardware information collected from kernel ring..mdx b/docs/Collecting Metrics/Collectors/Hardware and Sensors/Hardware information collected from kernel ring..mdx index eef248247..8aa39b75f 100644 --- a/docs/Collecting Metrics/Collectors/Hardware and Sensors/Hardware information collected from kernel ring..mdx +++ b/docs/Collecting Metrics/Collectors/Hardware and Sensors/Hardware information collected from kernel ring..mdx @@ -59,7 +59,15 @@ The default configuration for this integration is not expected to impose a signi ### Prerequisites -No action required. +#### Install the Netdata Driver (netdata_driver.sys) + +CPU temperature monitoring on Windows requires the Netdata kernel driver (`netdata_driver.sys`) to be installed on the host. The driver is an optional component and is not installed by default. + +When you install Netdata with the Windows MSI installer, select the **Netdata Driver: Hardware Metrics Collection** option on the feature selection screen. If Netdata is already installed without the driver, the installer's Change/Modify option does not expose this checkbox again; uninstall Netdata first, then reinstall it and select the option during setup. + +Editing `netdata.conf` alone is not enough. Without the driver, the `GetHardwareInfo` module cannot read the CPU `msr` register, so the `cpu.temperature` chart is never created and CPU temperature will not appear on the dashboard. The collector records an error in the Netdata log, but no temperature chart is produced. + + ### Configuration diff --git a/docs/Collecting Metrics/Collectors/Networking/tc QoS classes.mdx b/docs/Collecting Metrics/Collectors/Networking/tc QoS classes.mdx index 2717ff468..5b3fea920 100644 --- a/docs/Collecting Metrics/Collectors/Networking/tc QoS classes.mdx +++ b/docs/Collecting Metrics/Collectors/Networking/tc QoS classes.mdx @@ -180,3 +180,24 @@ Metrics: | tc.qos_dropped | Class Dropped Packets | a dimension per class | packets/s | | tc.qos_tokens | Class Tokens | a dimension per class | tokens | | tc.qos_ctokens | Class cTokens | a dimension per class | ctokens | + + + +## Troubleshooting + +### Recurring Cannot find file warnings for tc-qos-helper.conf + +When `tc-qos-helper.sh` starts, it looks for its configuration in two places, in this order: the stock configuration directory (typically at `/usr/lib/netdata/conf.d`) and the user [config directory](/docs/netdata-agent/configuration) (typically at `/etc/netdata`). Netdata does not ship a stock `tc-qos-helper.conf`, so on a default installation neither file exists and the script emits a `Cannot find file` warning for each missing path. + +These warnings are harmless. When no configuration file is found the script keeps its built-in defaults (for example `tc_show="qdisc"`). They reappear every hour because the script exits and is restarted by Netdata every 3600 seconds (`qos_exit_every=3600`), which re-runs the same checks on each start. + +Creating `tc-qos-helper.conf` in your user config directory with the desired setting silences the warning for the user configuration path. The warning for the stock path is expected to remain, because no stock `tc-qos-helper.conf` ships with Netdata, and it is benign. + + +### FireQOS is not installed warning + +When `tc-qos-helper.sh` starts and cannot find FireQOS (neither the `/var/run/fireqos` directory nor the `fireqos` executable), it logs that FireQOS is not installed on this system. This is normal on systems that do not perform QoS traffic shaping with FireQOS. + +Like the configuration warnings, this message repeats every hour because the script exits and is restarted by Netdata every 3600 seconds (`qos_exit_every=3600`), re-running the FireQOS presence check on each start. + +FireQOS is only required to apply QoS and expose human-readable class names to Netdata. Without it the plugin still collects `tc` qdisc/class metrics directly from the `tc` command. To expose FireQOS class names, [install FireQOS](https://firehol.org/tutorial/fireqos-new-user/). To map numeric class IDs to readable names without FireQOS, list them in `/etc/iproute2/tc_cls` and set `tc_show="class"` in `tc-qos-helper.conf` in your user config directory. diff --git a/docs/Collecting Metrics/Collectors/Operating Systems/System statistics.mdx b/docs/Collecting Metrics/Collectors/Operating Systems/System statistics.mdx index e1c110337..5fba4fd16 100644 --- a/docs/Collecting Metrics/Collectors/Operating Systems/System statistics.mdx +++ b/docs/Collecting Metrics/Collectors/Operating Systems/System statistics.mdx @@ -179,7 +179,7 @@ Labels: | Label | Description | |:-----------|:----------------| -| cpu | Identifier of the CPU core (e.g., core0, core1, core2). | +| cpu | Identifier of the CPU core (e.g., cpu0, cpu1, cpu2). | Metrics: diff --git a/docs/Network Performance Monitoring/Network Flows/Enrichment Methods/AWS IP Ranges.mdx b/docs/Network Performance Monitoring/Network Flows/Enrichment Methods/AWS IP Ranges.mdx index c03c7a8c3..d65765a8e 100644 --- a/docs/Network Performance Monitoring/Network Flows/Enrichment Methods/AWS IP Ranges.mdx +++ b/docs/Network Performance Monitoring/Network Flows/Enrichment Methods/AWS IP Ranges.mdx @@ -53,7 +53,7 @@ Schema of `ip-ranges.json`: For the cross-cutting concepts (how multiple network sources merge, the lookup priority vs static `networks` config, TLS verification rules, the jq engine and its expected output schema, fetch loop and retry/backoff), see -[Network Identity](https://learn.netdata.cloud/docs/network-performance-monitoring/network-flows/enrichment). +[Network Identity](/docs/network-performance-monitoring/network-flows/enrichment). The plugin issues a periodic GET to `https://ip-ranges.amazonaws.com/ip-ranges.json`, @@ -112,7 +112,7 @@ output (`tenant`, `region`, `role`, `name`, `site`, `city`, `country`, `state`, The expected `transform` output is a stream of objects, each carrying a `prefix` (CIDR string) plus any subset of the optional attribute fields. See the -cross-cutting [Network Identity](https://learn.netdata.cloud/docs/network-performance-monitoring/network-flows/enrichment) +cross-cutting [Network Identity](/docs/network-performance-monitoring/network-flows/enrichment) page for the full output schema. diff --git a/docs/Network Performance Monitoring/Network Flows/Enrichment Methods/Azure IP Ranges.mdx b/docs/Network Performance Monitoring/Network Flows/Enrichment Methods/Azure IP Ranges.mdx index 010b8bf26..8bd35e26e 100644 --- a/docs/Network Performance Monitoring/Network Flows/Enrichment Methods/Azure IP Ranges.mdx +++ b/docs/Network Performance Monitoring/Network Flows/Enrichment Methods/Azure IP Ranges.mdx @@ -47,7 +47,7 @@ and the rest -- without maintaining the prefix list yourself. For the full network-identity concept (merge order, jq output shape, TLS verification, failure modes), see -[Network Identity](https://learn.netdata.cloud/docs/network-performance-monitoring/network-flows/enrichment). +[Network Identity](/docs/network-performance-monitoring/network-flows/enrichment). Periodic HTTPS GET against the Service Tags JSON, jq transform via the diff --git a/docs/Network Performance Monitoring/Network Flows/Enrichment Methods/BMP BGP Monitoring Protocol.mdx b/docs/Network Performance Monitoring/Network Flows/Enrichment Methods/BMP BGP Monitoring Protocol.mdx index 5414bc5c1..26cbb2690 100644 --- a/docs/Network Performance Monitoring/Network Flows/Enrichment Methods/BMP BGP Monitoring Protocol.mdx +++ b/docs/Network Performance Monitoring/Network Flows/Enrichment Methods/BMP BGP Monitoring Protocol.mdx @@ -49,7 +49,7 @@ rollup. For the cross-cutting Enrichment concept (provider chains, shared trie with BioRIS, withdrawal handling, restart convergence), see -[Enrichment](https://learn.netdata.cloud/docs/network-performance-monitoring/network-flows/enrichment). +[Enrichment](/docs/network-performance-monitoring/network-flows/enrichment). The plugin runs a TCP listener on `0.0.0.0:10179`. This port is the Akvorado diff --git a/docs/Network Performance Monitoring/Network Flows/Enrichment Methods/CAIDA Routeviews Prefix-to-AS.mdx b/docs/Network Performance Monitoring/Network Flows/Enrichment Methods/CAIDA Routeviews Prefix-to-AS.mdx index 55ebfcea2..85bbda266 100644 --- a/docs/Network Performance Monitoring/Network Flows/Enrichment Methods/CAIDA Routeviews Prefix-to-AS.mdx +++ b/docs/Network Performance Monitoring/Network Flows/Enrichment Methods/CAIDA Routeviews Prefix-to-AS.mdx @@ -40,7 +40,7 @@ coordinates. For the IP-intelligence mechanism (lookup order, MMDB composition, refresh, provider chains), see -[IP Intelligence](https://learn.netdata.cloud/docs/network-performance-monitoring/network-flows/enrichment). +[IP Intelligence](/docs/network-performance-monitoring/network-flows/enrichment). The netflow plugin reads MMDB files only. CAIDA publishes compressed text data, diff --git a/docs/Network Performance Monitoring/Network Flows/Enrichment Methods/Classifiers.mdx b/docs/Network Performance Monitoring/Network Flows/Enrichment Methods/Classifiers.mdx index 24ee421fe..4c67c734b 100644 --- a/docs/Network Performance Monitoring/Network Flows/Enrichment Methods/Classifiers.mdx +++ b/docs/Network Performance Monitoring/Network Flows/Enrichment Methods/Classifiers.mdx @@ -27,7 +27,7 @@ Module: classifiers ## Overview Annotate network flows with exporter and interface labels derived from reusable -classification rules. Where [static metadata](https://learn.netdata.cloud/docs/network-performance-monitoring/network-flows/enrichment) +classification rules. Where [static metadata](/docs/network-performance-monitoring/network-flows/enrichment) forces you to enumerate every exporter and every ifIndex by hand, classifiers let you express the network design once -- "anything matching `^edge-` is the edge tier", "any interface with `BACKBONE-LUMEN` in its description is on @@ -64,7 +64,7 @@ normalisation. For the cross-cutting Enrichment concept (where classifiers sit in the merge order vs static metadata, GeoIP, IPAM, BGP routing), see -[Enrichment](https://learn.netdata.cloud/docs/network-performance-monitoring/network-flows/enrichment). +[Enrichment](/docs/network-performance-monitoring/network-flows/enrichment). Each rule is a single boolean expression; an action with no condition (e.g. @@ -135,7 +135,7 @@ Classifiers shine when there is a pattern to match -- exporter naming conventions (`edge-...`, `core-...`), management-IP subnets per site, SNMP interface descriptions that follow a template (`BACKBONE-`, `TRANSIT-...`, `IX-...`), or 100Gbps-equals-core conventions. If your -fleet has no such pattern, [static metadata](https://learn.netdata.cloud/docs/network-performance-monitoring/network-flows/enrichment) +fleet has no such pattern, [static metadata](/docs/network-performance-monitoring/network-flows/enrichment) is the better fit -- it lets you list each exporter and ifIndex by hand. diff --git a/docs/Network Performance Monitoring/Network Flows/Enrichment Methods/Custom MMDB Database.mdx b/docs/Network Performance Monitoring/Network Flows/Enrichment Methods/Custom MMDB Database.mdx index ce8a5cc42..fff7b7fa6 100644 --- a/docs/Network Performance Monitoring/Network Flows/Enrichment Methods/Custom MMDB Database.mdx +++ b/docs/Network Performance Monitoring/Network Flows/Enrichment Methods/Custom MMDB Database.mdx @@ -48,7 +48,7 @@ State and country survive into all four tiers. For the full IP-intelligence concept (composition rule, ASN provider chain, auto-detect path order, dual-stack handling, hot reload semantics), see -[IP Intelligence](https://learn.netdata.cloud/docs/network-performance-monitoring/network-flows/enrichment). +[IP Intelligence](/docs/network-performance-monitoring/network-flows/enrichment). You build (or download) the MMDB file with your own tooling, place it on the @@ -228,7 +228,7 @@ The plugin reloads custom databases the same way it reloads stock ones plugin will pick it up; if it was edited byte-by-byte (rare with MMDB builders) verify size or mtime actually changed. The reload mechanism and its 30-second cadence are documented in -[IP Intelligence](https://learn.netdata.cloud/docs/network-performance-monitoring/network-flows/enrichment). +[IP Intelligence](/docs/network-performance-monitoring/network-flows/enrichment). Operational practice: have your build pipeline write the new MMDB to a temp file in the same directory and `rename(2)` it over the live path so the swap is atomic. diff --git a/docs/Network Performance Monitoring/Network Flows/Enrichment Methods/DB-IP IP Intelligence.mdx b/docs/Network Performance Monitoring/Network Flows/Enrichment Methods/DB-IP IP Intelligence.mdx index fe4b34d31..79aefa371 100644 --- a/docs/Network Performance Monitoring/Network Flows/Enrichment Methods/DB-IP IP Intelligence.mdx +++ b/docs/Network Performance Monitoring/Network Flows/Enrichment Methods/DB-IP IP Intelligence.mdx @@ -56,7 +56,7 @@ Populates these flow record fields when a lookup succeeds: For the cross-provider mechanics (lookup pass ordering, the 30-second hot-reload poll, the auto-detect path order, multi-database composition, IPv4/IPv6 handling, the failure modes shared by every MMDB provider), see -[IP Intelligence](https://learn.netdata.cloud/docs/network-performance-monitoring/network-flows/enrichment). +[IP Intelligence](/docs/network-performance-monitoring/network-flows/enrichment). Files are read on plugin start and reloaded automatically when their mtime or size @@ -103,7 +103,7 @@ the binary is available (packaged 32-bit installs do not include it) to populate sudo /usr/sbin/topology-ip-intel-downloader ``` -See the [Enrichment Intel Downloader](https://learn.netdata.cloud/docs/network-performance-monitoring/network-flows/enrichment-intel-downloader) +See the [Enrichment Intel Downloader](/docs/network-performance-monitoring/network-flows/enrichment-intel-downloader) page for downloader options and how to schedule periodic refreshes. DB-IP Lite data is published monthly, so a monthly cron of the downloader is the right cadence -- more frequent runs will not produce newer data. @@ -196,7 +196,7 @@ private space. The DB-IP-built ASN database tags private ranges so `*_AS_NAME` renders as `AS0 Private IP Address Space`, while geographic fields stay empty and private addresses do not appear on maps. Declare your internal CIDRs under `enrichment.networks` when you want internal labels -- see -[Static metadata](https://learn.netdata.cloud/docs/network-performance-monitoring/network-flows/enrichment). +[Private and non-routable IPs](/docs/network-performance-monitoring/network-flows/enrichment#private-and-non-routable-ips). ### Stale databases diff --git a/docs/Network Performance Monitoring/Network Flows/Enrichment Methods/Decapsulation.mdx b/docs/Network Performance Monitoring/Network Flows/Enrichment Methods/Decapsulation.mdx index 671531593..92e73a8b9 100644 --- a/docs/Network Performance Monitoring/Network Flows/Enrichment Methods/Decapsulation.mdx +++ b/docs/Network Performance Monitoring/Network Flows/Enrichment Methods/Decapsulation.mdx @@ -68,7 +68,7 @@ surfaces the inner IPv4 or IPv6 packet pointed to by next-header 4 or 41. For the cross-cutting concept (how decap composes with the rest of the enrichment pipeline, the non-tunnel "drop, do not fall back" semantics, and per-source dependence on the L2-section path), see -[Decapsulation](https://learn.netdata.cloud/docs/network-performance-monitoring/network-flows/enrichment). +[Decapsulation](/docs/network-performance-monitoring/network-flows/enrichment). Set `protocols.decapsulation_mode` in `netflow.yaml` to `srv6` or `vxlan`. The diff --git a/docs/Network Performance Monitoring/Network Flows/Enrichment Methods/GCP IP Ranges.mdx b/docs/Network Performance Monitoring/Network Flows/Enrichment Methods/GCP IP Ranges.mdx index fadaef1e8..ff9166d30 100644 --- a/docs/Network Performance Monitoring/Network Flows/Enrichment Methods/GCP IP Ranges.mdx +++ b/docs/Network Performance Monitoring/Network Flows/Enrichment Methods/GCP IP Ranges.mdx @@ -49,7 +49,7 @@ Two upstream files exist and they are NOT interchangeable: For the cross-cutting network-identity behavior (merge order with GeoIP and static config, jq output contract, TLS rules, single-page fetch, failure / backoff handling), see -[Network Identity](https://learn.netdata.cloud/docs/network-performance-monitoring/network-flows/enrichment). +[Network Identity](/docs/network-performance-monitoring/network-flows/enrichment). Periodic HTTPS GET against the chosen `gstatic.com` URL. The body is parsed diff --git a/docs/Network Performance Monitoring/Network Flows/Enrichment Methods/Generic JSON-over-HTTP IPAM.mdx b/docs/Network Performance Monitoring/Network Flows/Enrichment Methods/Generic JSON-over-HTTP IPAM.mdx index 3090380f3..fb1e7482a 100644 --- a/docs/Network Performance Monitoring/Network Flows/Enrichment Methods/Generic JSON-over-HTTP IPAM.mdx +++ b/docs/Network Performance Monitoring/Network Flows/Enrichment Methods/Generic JSON-over-HTTP IPAM.mdx @@ -42,7 +42,7 @@ that specific provider. For the full network-identity concept (merge order vs GeoIP and static, what fields you can populate, why TLS verification cannot be disabled), see -[Network Identity](https://learn.netdata.cloud/docs/network-performance-monitoring/network-flows/enrichment). +[Network Identity](/docs/network-performance-monitoring/network-flows/enrichment). The plugin issues a periodic HTTP request (GET by default, POST optionally) to diff --git a/docs/Network Performance Monitoring/Network Flows/Enrichment Methods/IP2Location LITE IP-Country.mdx b/docs/Network Performance Monitoring/Network Flows/Enrichment Methods/IP2Location LITE IP-Country.mdx index 4fe7d0922..1eeb9b6e2 100644 --- a/docs/Network Performance Monitoring/Network Flows/Enrichment Methods/IP2Location LITE IP-Country.mdx +++ b/docs/Network Performance Monitoring/Network Flows/Enrichment Methods/IP2Location LITE IP-Country.mdx @@ -37,7 +37,7 @@ MaxMind ASN data when you also need AS fields. For the IP-intelligence mechanism (lookup order, MMDB composition, refresh, provider chains), see -[IP Intelligence](https://learn.netdata.cloud/docs/network-performance-monitoring/network-flows/enrichment). +[IP Intelligence](/docs/network-performance-monitoring/network-flows/enrichment). The netflow plugin reads MMDB files only. Use Netdata's diff --git a/docs/Network Performance Monitoring/Network Flows/Enrichment Methods/IPDeny Country Zones.mdx b/docs/Network Performance Monitoring/Network Flows/Enrichment Methods/IPDeny Country Zones.mdx index a8e2996ed..9ae515afc 100644 --- a/docs/Network Performance Monitoring/Network Flows/Enrichment Methods/IPDeny Country Zones.mdx +++ b/docs/Network Performance Monitoring/Network Flows/Enrichment Methods/IPDeny Country Zones.mdx @@ -39,7 +39,7 @@ coverage is required. For the IP-intelligence mechanism (lookup order, MMDB composition, refresh, provider chains), see -[IP Intelligence](https://learn.netdata.cloud/docs/network-performance-monitoring/network-flows/enrichment). +[IP Intelligence](/docs/network-performance-monitoring/network-flows/enrichment). The netflow plugin reads MMDB files only. Use Netdata's diff --git a/docs/Network Performance Monitoring/Network Flows/Enrichment Methods/IPIP Country Database.mdx b/docs/Network Performance Monitoring/Network Flows/Enrichment Methods/IPIP Country Database.mdx index 75e7828d2..1d22c61f1 100644 --- a/docs/Network Performance Monitoring/Network Flows/Enrichment Methods/IPIP Country Database.mdx +++ b/docs/Network Performance Monitoring/Network Flows/Enrichment Methods/IPIP Country Database.mdx @@ -38,7 +38,7 @@ custom MMDB when IPv6 country coverage is required. For the IP-intelligence mechanism (lookup order, MMDB composition, refresh, provider chains), see -[IP Intelligence](https://learn.netdata.cloud/docs/network-performance-monitoring/network-flows/enrichment). +[IP Intelligence](/docs/network-performance-monitoring/network-flows/enrichment). The netflow plugin reads MMDB files only. Use Netdata's diff --git a/docs/Network Performance Monitoring/Network Flows/Enrichment Methods/IPtoASN.mdx b/docs/Network Performance Monitoring/Network Flows/Enrichment Methods/IPtoASN.mdx index 632df1beb..6e1c61002 100644 --- a/docs/Network Performance Monitoring/Network Flows/Enrichment Methods/IPtoASN.mdx +++ b/docs/Network Performance Monitoring/Network Flows/Enrichment Methods/IPtoASN.mdx @@ -45,7 +45,7 @@ or coordinates. For the IP-intelligence mechanism (lookup order, MMDB composition, refresh, provider chains), see -[IP Intelligence](https://learn.netdata.cloud/docs/network-performance-monitoring/network-flows/enrichment). +[IP Intelligence](/docs/network-performance-monitoring/network-flows/enrichment). The Netdata plugin reads MMDB only. IPtoASN ships gzipped TSV @@ -75,7 +75,7 @@ This integration runs as a single instance per Netdata Agent. Not auto-detected as the default ASN source -- the plugin auto-detects DB-IP MMDBs in the cache directory at startup -(see [IP Intelligence](https://learn.netdata.cloud/docs/network-performance-monitoring/network-flows/enrichment)). +(see [IP Intelligence](/docs/network-performance-monitoring/network-flows/enrichment)). To use IPtoASN, run `topology-ip-intel-downloader` when available to produce IPtoASN-derived MMDBs (the downloader writes to the same cache paths the plugin scans, so once present they are picked up automatically on the 30-second @@ -231,7 +231,7 @@ no organisation. This is data-source-level, not a plugin issue. If richer AS-nam coverage matters, layer a MaxMind GeoLite2-ASN MMDB after IPtoASN in `asn_database` -- per-field "last database with a non-empty value wins" composition (see -[IP Intelligence](https://learn.netdata.cloud/docs/network-performance-monitoring/network-flows/enrichment)) +[IP Intelligence](/docs/network-performance-monitoring/network-flows/enrichment)) means MaxMind names override IPtoASN's empty entries. diff --git a/docs/Network Performance Monitoring/Network Flows/Enrichment Methods/MaxMind GeoIP GeoLite2.mdx b/docs/Network Performance Monitoring/Network Flows/Enrichment Methods/MaxMind GeoIP GeoLite2.mdx index 3494448a6..ee11bb328 100644 --- a/docs/Network Performance Monitoring/Network Flows/Enrichment Methods/MaxMind GeoIP GeoLite2.mdx +++ b/docs/Network Performance Monitoring/Network Flows/Enrichment Methods/MaxMind GeoIP GeoLite2.mdx @@ -50,7 +50,7 @@ bounded-cardinality geography columns. For the cross-cutting concept (resolver poll loop, multi-database composition, ASN provider chain, failure-modes table), see -[IP Intelligence](https://learn.netdata.cloud/docs/network-performance-monitoring/network-flows/enrichment). +[IP Intelligence](/docs/network-performance-monitoring/network-flows/enrichment). You can use MaxMind in two ways: @@ -173,7 +173,7 @@ format.) Override the default DB-IP auto-detection by pointing `asn_database` and `geo_database` at your MaxMind MMDB files. Both keys take a list -- you can chain MaxMind alongside other MMDB sources; see the -[IP Intelligence](https://learn.netdata.cloud/docs/network-performance-monitoring/network-flows/enrichment) +[IP Intelligence](/docs/network-performance-monitoring/network-flows/enrichment) page for the per-field "last non-empty wins" composition rule. @@ -243,7 +243,7 @@ enrichment: ###### MaxMind ASN + DB-IP geo (mixed) -Use MaxMind for ASN richness and keep the bundled DB-IP geo file. Both lookups run; the multi-DB composition rule is documented on the [IP Intelligence](https://learn.netdata.cloud/docs/network-performance-monitoring/network-flows/enrichment) page. +Use MaxMind for ASN richness and keep the bundled DB-IP geo file. Both lookups run; the multi-DB composition rule is documented on the [IP Intelligence](/docs/network-performance-monitoring/network-flows/enrichment) page.
Config @@ -292,6 +292,6 @@ AS data. The plugin loads every configured MMDB. If you list both, the per-field "last non-empty wins" rule applies (see the -[IP Intelligence](https://learn.netdata.cloud/docs/network-performance-monitoring/network-flows/enrichment) +[IP Intelligence](/docs/network-performance-monitoring/network-flows/enrichment) concept page). Order matters: list the source whose values you want to win **last**. diff --git a/docs/Network Performance Monitoring/Network Flows/Enrichment Methods/NetBox.mdx b/docs/Network Performance Monitoring/Network Flows/Enrichment Methods/NetBox.mdx index ddf5bbe70..5e81e5ff3 100644 --- a/docs/Network Performance Monitoring/Network Flows/Enrichment Methods/NetBox.mdx +++ b/docs/Network Performance Monitoring/Network Flows/Enrichment Methods/NetBox.mdx @@ -40,7 +40,7 @@ transforms the response with jq, and labels matching flow prefixes with whatever fields you map. NetBox is the authoritative source -- when the same prefix is tagged in NetBox and in the static `networks:` block, the static block wins (operator override is intentional, see the -[Network Identity](https://learn.netdata.cloud/docs/network-performance-monitoring/network-flows/enrichment) +[Network Identity](/docs/network-performance-monitoring/network-flows/enrichment) concept page). Use cases: applying your organisation's data-centre rack labels, tenant names, diff --git a/docs/Network Performance Monitoring/Network Flows/Enrichment Methods/Static Metadata.mdx b/docs/Network Performance Monitoring/Network Flows/Enrichment Methods/Static Metadata.mdx index d5bbd8436..f48a90798 100644 --- a/docs/Network Performance Monitoring/Network Flows/Enrichment Methods/Static Metadata.mdx +++ b/docs/Network Performance Monitoring/Network Flows/Enrichment Methods/Static Metadata.mdx @@ -76,7 +76,7 @@ Fields populated: For the cross-cutting Enrichment concept (provider chains, merge order rules, how static composes with dynamic sources, the static-blocks-classifiers interaction, and shared failure modes), see -[Enrichment](https://learn.netdata.cloud/docs/network-performance-monitoring/network-flows/enrichment). +[Enrichment](/docs/network-performance-monitoring/network-flows/enrichment). Edit `netflow.yaml`, restart the plugin, and the YAML-defined data is loaded @@ -151,7 +151,7 @@ load with a parse error. | enrichment.metadata_static.exporters.<key>.if_indexes.<n>.boundary | Interface boundary marker. Accepts the integers `0` (undefined), `1` (external -- faces the outside world: Internet, peer, transit), `2` (internal -- faces your own infrastructure), or the case-insensitive strings `"undefined"`, `"external"`, `"internal"`. Any other value fails config load. Filtering for `IN_IF_BOUNDARY=1` cleanly gives you "traffic that arrived from outside". | 0 | no | | enrichment.metadata_static.exporters.<key>.if_indexes.<n>.speed | Interface speed in **bits per second**. A 1 Gbps interface is `1000000000`, not `1000` and not `1000000`. Operators thinking in megabits get the value wrong by a factor of 1000 to 1000000. A `0` value means "not set" and removes the field from the output. | 0 | no | | enrichment.networks | Map keyed by CIDR. Longest-prefix match contributes the most-specific fields; less-specific containing prefixes contribute their non-empty fields too. The same merge rule is used by `network_sources`. Each value is either a string (shorthand for `name:`) or a map with `name`, `role`, `site`, `region`, `country`, `state`, `city`, `latitude`, `longitude`, `tenant`, `asn`. | \{} | no | -| enrichment.networks.<cidr>.asn | Forces the AS *number* for traffic in this prefix, overriding whatever the `asn_providers` chain computed. The AS *name* is still resolved from the ASN MMDB -- there is no `asn_name` config field. See the ASN section of [Enrichment](https://learn.netdata.cloud/docs/network-performance-monitoring/network-flows/enrichment). | 0 | no | +| enrichment.networks.<cidr>.asn | Forces the AS *number* for traffic in this prefix, overriding whatever the `asn_providers` chain computed. The AS *name* is still resolved from the ASN MMDB -- there is no `asn_name` config field. See the ASN section of [Enrichment](/docs/network-performance-monitoring/network-flows/enrichment). | 0 | no | | enrichment.networks.<cidr>.latitude / longitude | Per-CIDR coordinate override. Out-of-range values (latitude not in [-90, 90] or longitude not in [-180, 180]) and non-finite values are silently coerced to empty strings -- the field is dropped, no error. Validate input out of band if your data matters. | null | no | | enrichment.default_sampling_rate | Global fallback applied only when the flow record does not already carry a sampling rate. Either a single integer or a CIDR-keyed map (longest-prefix match against the exporter IP). | 0 | no | | enrichment.override_sampling_rate | Per-exporter substitution that **always** wins when its prefix matches the exporter IP, regardless of what the flow record carried. Either a single integer or a CIDR-keyed map. | \{} | no | @@ -315,10 +315,7 @@ entry to overwrite. The same merge rule applies to entries from ### GeoIP returns spurious data for an internal range -Until you declare your RFC1918 / RFC6598 / link-local ranges as -`enrichment.networks` entries, the GeoIP-derived country / city / coord -fields can pick up junk for those addresses. Adding a `networks` entry -for the range overrides the GeoIP layer at the merge step. +Declare an `enrichment.networks` entry for the range to override the GeoIP layer at the merge step -- see [Private and non-routable IPs](/docs/network-performance-monitoring/network-flows/enrichment#private-and-non-routable-ips) for why GeoIP is unreliable for RFC1918 / RFC6598 / link-local ranges and how the override works. ### ifIndex changed after a hardware swap diff --git a/docs/Network Performance Monitoring/Network Flows/Enrichment.mdx b/docs/Network Performance Monitoring/Network Flows/Enrichment.mdx index c21405b2f..384f98432 100644 --- a/docs/Network Performance Monitoring/Network Flows/Enrichment.mdx +++ b/docs/Network Performance Monitoring/Network Flows/Enrichment.mdx @@ -359,6 +359,12 @@ See [Retention and querying](/docs/network-performance-monitoring/network-flows/ City-level GeoIP is accurate for many public IPs but wrong for VPNs, mobile carriers, and cloud-provider egress IPs (which often resolve to the cloud region's central city, not the actual user). Use country and state for trends; use city only after validating it for the prefix you care about. ASN ownership data also drifts — companies merge, prefixes get reassigned. A database older than a quarter or two starts labelling reassigned prefixes with the previous owner. +### Private and non-routable IPs + +CIDR-based enrichment is IP-agnostic. Both static `enrichment.networks` and dynamic `network_sources` match prefixes for any address — RFC 1918 (`10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`), RFC 6598 carrier-grade NAT (`100.64.0.0/10`), and link-local (`169.254.0.0/16`) are matched the same way as public ranges. GeoIP databases carry no reliable country, city, or coordinate data for these addresses, and the ASN MMDB may render them as `AS0 Private IP Address Space` (see [AS numbers vs AS names](#as-numbers-vs-as-names)). + +To label private-IP traffic, declare those ranges as `enrichment.networks` entries. The merge step overlays non-empty static fields (`name`, `role`, `site`, `region`, `tenant`, `country`, `city`, `latitude`, `longitude`) on top of the GeoIP base layer, so your operator-defined values replace whatever GeoIP produced — or nothing at all. The `network_sources` jq schema earlier on this page applies the same pattern with `10.0.0.0/8` tagged `name: internal, role: lan`; static `networks` accepts those fields plus `latitude` and `longitude`. See the [Static Metadata](/docs/network-performance-monitoring/network-flows/enrichment-methods/static-metadata) integration card for configuration examples and the merge-order details. + ### Sampling-rate knobs Two related, easily confused knobs (set under `enrichment` in `netflow.yaml`): diff --git a/docs/Network Performance Monitoring/Network Flows/Flow Protocols/IPFIX.mdx b/docs/Network Performance Monitoring/Network Flows/Flow Protocols/IPFIX.mdx index d4fc27bcf..3d56a5250 100644 --- a/docs/Network Performance Monitoring/Network Flows/Flow Protocols/IPFIX.mdx +++ b/docs/Network Performance Monitoring/Network Flows/Flow Protocols/IPFIX.mdx @@ -33,7 +33,7 @@ any additional IEs the exporter provides. For full documentation including vendor configuration examples (Cisco, Juniper, Arista), biflow handling, sampling caveats, and verification steps, see the -[Network Flows Overview](https://learn.netdata.cloud/docs/network-performance-monitoring/network-flows/). +[Network Flows Overview](/docs/network-performance-monitoring/network-flows). The plugin uses the same configurable UDP listener set as NetFlow. IPFIX messages are identified by @@ -135,10 +135,10 @@ protocols: ### Verifying flow data is arriving and diagnosing failures -See [Troubleshooting](https://learn.netdata.cloud/docs/network-performance-monitoring/network-flows/troubleshooting) for +See [Troubleshooting](/docs/network-performance-monitoring/network-flows/troubleshooting) for the full diagnostic recipe. Use `netflow.input_packets` for UDP arrival, `netflow.protocol_packets` for v5/v7/v9/IPFIX/sFlow identification, and `netflow.decoder_exceptions` for parse failures. For v9/IPFIX, watch the missing-template dimensions on `netflow.flow_sets`; Data Sets arriving before their templates cannot be decoded. See also -[Validation and Data Quality](https://learn.netdata.cloud/docs/network-performance-monitoring/network-flows/validation-and-data-quality). +[Validation and Data Quality](/docs/network-performance-monitoring/network-flows/validation-and-data-quality). diff --git a/docs/Network Performance Monitoring/Network Flows/Flow Protocols/NetFlow.mdx b/docs/Network Performance Monitoring/Network Flows/Flow Protocols/NetFlow.mdx index 26d645c3f..bdc113ca4 100644 --- a/docs/Network Performance Monitoring/Network Flows/Flow Protocols/NetFlow.mdx +++ b/docs/Network Performance Monitoring/Network Flows/Flow Protocols/NetFlow.mdx @@ -36,7 +36,7 @@ become directional traffic rows; create, teardown, deny, malformed, and counterl events remain diagnostics and do not enter the flow database. For full documentation including vendor configuration examples, sampling caveats, template -handling and verification steps, see the [Network Flows Overview](https://learn.netdata.cloud/docs/network-performance-monitoring/network-flows/). +handling and verification steps, see the [Network Flows Overview](/docs/network-performance-monitoring/network-flows). The plugin listens on configurable UDP listener sockets for NetFlow datagrams. @@ -168,9 +168,9 @@ journal: ### Verifying flow data is arriving and diagnosing failures -See [Troubleshooting](https://learn.netdata.cloud/docs/network-performance-monitoring/network-flows/troubleshooting) for +See [Troubleshooting](/docs/network-performance-monitoring/network-flows/troubleshooting) for the full diagnostic recipe -- including UDP path checks, template-error analysis, Cisco ASA NSEL event handling, and the "looks like a bug but isn't" section (doubling, mirroring, internal-IP geolocation). -See also [Validation and Data Quality](https://learn.netdata.cloud/docs/network-performance-monitoring/network-flows/validation-and-data-quality) -and [Anti-patterns](https://learn.netdata.cloud/docs/network-performance-monitoring/network-flows/anti-patterns). +See also [Validation and Data Quality](/docs/network-performance-monitoring/network-flows/validation-and-data-quality) +and [Anti-patterns](/docs/network-performance-monitoring/network-flows/anti-patterns). diff --git a/docs/Network Performance Monitoring/Network Flows/Flow Protocols/sFlow.mdx b/docs/Network Performance Monitoring/Network Flows/Flow Protocols/sFlow.mdx index cbe748150..58850264e 100644 --- a/docs/Network Performance Monitoring/Network Flows/Flow Protocols/sFlow.mdx +++ b/docs/Network Performance Monitoring/Network Flows/Flow Protocols/sFlow.mdx @@ -34,7 +34,7 @@ and sampling rate information. For full documentation including how sFlow differs fundamentally from NetFlow (packet sampling vs aggregated flows), vendor configuration examples (Arista, Juniper, Aruba CX, Ruckus, hsflowd), and the limits of sampled data, see the -[Network Flows Overview](https://learn.netdata.cloud/docs/network-performance-monitoring/network-flows/). +[Network Flows Overview](/docs/network-performance-monitoring/network-flows). The plugin uses the same configurable UDP listener set as NetFlow/IPFIX. sFlow datagrams are identified by @@ -134,7 +134,7 @@ protocols: ### Verifying sFlow is arriving and diagnosing failures -See [Troubleshooting](https://learn.netdata.cloud/docs/network-performance-monitoring/network-flows/troubleshooting) for +See [Troubleshooting](/docs/network-performance-monitoring/network-flows/troubleshooting) for the full diagnostic recipe. sFlow-specific gotchas: Netdata creates Network Flow rows from sFlow flow samples (`flow_sample` / `expanded_flow_sample`) only. Counter-only streams (`counters_sample` / `expanded_counters_sample`) are valid sFlow and increment @@ -143,5 +143,5 @@ records for the Flow Explorer, Sankey, time-series, or maps. Bytes/packets are statistical estimates that won't match SNMP byte-for-byte, and VLAN information comes from `ExtendedSwitch` records only -- not from 802.1Q tags inside the sampled header. See also -[Validation and Data Quality](https://learn.netdata.cloud/docs/network-performance-monitoring/network-flows/validation-and-data-quality) -and the sFlow section of [Anti-patterns](https://learn.netdata.cloud/docs/network-performance-monitoring/network-flows/anti-patterns). +[Validation and Data Quality](/docs/network-performance-monitoring/network-flows/validation-and-data-quality) +and the sFlow section of [Anti-patterns](/docs/network-performance-monitoring/network-flows/anti-patterns).