sFlow

Synopsis

Creates an sFlow collector that accepts flow sampling data over UDP connections. Supports high-volume collection with multiple workers.

For details, see Appendix.

Schema

- id: <numeric>
  name: <string>
  description: <string>
  type: sflow
  tags: <string[]>
  pipelines: <pipeline[]>
  status: <boolean>
  properties:
    address: <string>
    port: <numeric>
    workers: <numeric>
    reuse: <boolean>

Configuration

The following fields are used to define the device:

Device

Field	Required	Default	Description
id	Y		Unique identifier
name	Y		Device name
description	N	-	Optional description
type	Y		Must be sflow
tags	N	-	Optional tags
pipelines	N	-	Optional pre-processor pipelines
status	N	true	Enable/disable the device

Connection

Field	Required	Default	Description
address	N	"0.0.0.0"	Listen address
port	N	6343	Listen port
workers	N	CPU count	Number of worker goroutines
reuse	N	false	Enable socket address reuse

Details

NetFlow, sFlow, and IPFIX devices share a common flow collection backend (backend/module/listener/flow/). The thin per-protocol controller sets the flow type and default port.

When reuse is enabled, the collector automatically scales to use multiple worker processes based on available CPU cores. Each worker maintains its own UDP listener, processes flows independently, and writes to a dedicated queue file.

The collector supports interface-counter sampling, packet-flow sampling, application identification, port-based protocol mapping, flow-state tracking, and statistical aggregation.

Examples

The following are commonly used configuration types.

Basic

Creating a simple sFlow collector on the default port...

devices: - id: 1 name: basic_sflow type: sflow properties: port: 6343

High-Volume

Optimizing for high flow volumes using multiple workers...

devices: - id: 2 name: performant_sflow type: sflow properties: address: "0.0.0.0" port: 6343 reuse: true workers: 4

warning

All sFlow agents must be configured to send to the same collector port.

Loading include...

sFlow collector with application identification enabled...

devices: - id: 3 name: app_aware_sflow type: sflow properties: port: 6343 reuse: true