Skip to main content
Version: 2.9.1

Sampling Monitor (10002 / 20002)


This Module reports NetFlow sampling information. For NFv5 sampling interval is taken from the header. For NFv9 and IPFIX sampling interval and other fields are taken from NetFlow options. For sFlow sampling interval is taken from sampling rate.


Parameter NameDescriptionComments
Data Collection Interval, secModule logic execution intervalmin = 10 sec, max = 600 sec, default = 60 sec
Default sampling intervalSampling interval used in case no NFv9 options are availablemin = 1, max = 100000, default = 1
Sampling info expiration timeStop sending sampling information after this time of not seeing any traffic from the network devicemin = 1 sec, max = 100000 sec, default = 300 sec


NetFlow v5, v9, IPFIX, sFlow

Required NetFlow Fields

Information Element (IE)IE idIE size, BDescription
samplerId481The unique identifier associated with samplerName. Attention: this IE is deprecated in favor of selectorId (302)

Syslog/JSON Message Fields

KeyField DescriptionComments
nfc_idMessage type identifier"nfc_id=20002"
exp_ipNetFlow exporter IP address<IPv4_address>
flow_smpl_idFlow Sampler ID<number>
smpl_intSampling interval<number>
smpl_algoSampling algorithm<string>
t_intObservation time interval, msec<number>