User's Guide
Table Of Contents
- ExtremeAnalytics® User GuideVersion 8.4
- Legal Notices
- Trademarks
- Contact
- Extreme Networks® Software License Agreement
- Table of Contents
- ExtremeAnalytics™ Help
- ExtremeAnalytics Licensing
- Configuring Enhanced Netflow for Extreme Analytics and Extreme Wireless Contr...
- How to Deploy ExtremeAnalytics in an MSP or MSSP Environment
- ExtremeAnalytics Tab Overview
- ExtremeAnalytics Dashboard Overview
- ExtremeAnalytics Insights Dashboard
- ExtremeAnalytics Tracked Applications Dashboard
- ExtremeAnalytics Browser Overview
- ExtremeAnalytics Application Flows
- ExtremeAnalytics Fingerprints Overview
- ExtremeAnalytics Custom Fingerprints
- Delete Custom Fingerprints
- Custom Fingerprint Examples
- Create Custom Fingerprints Based on Flow
- Create Custom Fingerprints Based on Destination Address
- Create Custom Fingerprints Based on Application or Application Group
- ExtremeAnalytics Packet Captures
- ExtremeAnalytics Configuration Overview
- Virtual Sensors
- ExtremeAnalytics Engine Advanced Configuration
- Flow Collection Type
- Collection Privacy Levels
- Client Aggregation
- Slow Client Data
- Max End-Systems in Hourly Details
- Sensor Log Levels
- Store Application Site Data
- ExtremeControl Integration
- Flow Sources/Application Telemetry Sources
- Web Credentials
- Configuration Properties
- Sensor Modules
- Auditing
- Network Settings
- ExtremeAnalytics Reports
- ExtremeAnalytics Report Descriptions
- Report Descriptions
- Analytics Events
- Bandwidth for a Client Over Time
- Interface Top Applications Treemap
- Sites Using the Most Bandwidth
- Most Popular Applications
- Most Used Applications for a Client
- Most Used Applications for a User Name
- Network Activity by Site
- Network Activity by Client
- Network Activity by Application
- Slowest Applications by Site
- Top Applications Group Radar
- Top Applications Radar
- Top Applications TreeMap
- Top Applications for Interface
- Top Applications for Server
- Top Clients by Interface
- Top Interfaces by Application
- Top N Applications
- Top N Clients
- Top N Servers
- Report Descriptions
- Add and Modify Fingerprints
- Add Fingerprints
- Enable or Disable Fingerprints
- Modify Fingerprints
- Update Fingerprints
- Custom Fingerprint Examples
- How to Deploy ExtremeAnalytics in an MSP or MSSP Environment
- ExtremeAnalytics Virtual Sensor Configuration in Extreme Management Center
- Stream Flow Data from ExtremeAnalytics into Splunk
- Stream Flow Data from ExtremeAnalytics into Elastic Stack
Data Collection Overview
40 of 218
Data from network flows is collected in an aggregated form for a period of time
(called a collection interval), and then stored in the Extreme Management Center
database. Extreme Management Center uses this data to provide reports that
show how your network is being utilized.
To conserve space on your Extreme Management Center server hard drive, your
ExtremeAnalytics engines only collect total flow records when the server hard
drive drops below 10 GBof free space. If the Extreme Management Center server
hard drive drops an additional 1 GB (under 9 GBof free space), your
ExtremeAnalytics engines stop collecting all flow data.
NOTE: To change the differential threshold (the additional amount of free space reduction after which
all records stop being collected), edit the RM_FREE_SPACE_MINIMUM_ALLOW_SUMMARY_
KB value in the NSJBOSS.properties file. The value is set to 1,000,000 KB by default, so
ExtremeAnalytics stops collecting all records when free space reaches 10GB - 1,000,000 KB = 9
GB.
Collection Targets
Flow data is collected on objects in your network called targets. Some targets
are physical, such as clients and servers, and some are logical, such as
applications.
An ExtremeAnalytics engine can track the following target types:
l Client — The end-point of a flow that has the client role for that connection.
l Server — The end-point of a flow that has the server role for that connection.
l Application — An application in ExtremeAnalytics, identified through layer 7
analysis (for example, Facebook).
l Application Group — Application categories, such as Cloud Computing or Social
Networking.
l Site — The client's physical location on the network, based on its IP address. Sites
are used by ExtremeAnalytics to identify the physical location for the client of an
application flow.
l Device Family — The kind of device determined for a client, such as Windows or iOS.
l Profile — An ExtremeControl profile assigned to a client.
In some cases, the engine can also track combinations of targets. For example, it
can track the total number of bytes transferred from Workstation 1 for the Payroll