Skip to main content
Version: Next

Deployment & Configuration: Sumo Logic

NetFlow Optimizer (NFO) delivers its enriched flow data to Sumo Logic as JSON over UDP, to a Syslog Source on a Sumo Logic Installed Collector. The collector can run on the NFO host itself or on a separate host or virtual machine.

Sending the output as JSON lets Sumo Logic's Dynamic Parsing extract the fields automatically, so no manual field extraction rules are required.

1. Install the Sumo Logic Collector​

Install an Installed Collector on the NFO host or on a host that NFO can reach over UDP. See the Sumo Logic Installed Collectors documentation for platform-specific instructions.

2. Configure the Collector​

Connect the collector to your Sumo Logic environment by editing user.properties in the /opt/SumoCollector/config/ directory. The collector reads this file to register and start.

To authenticate with an access key, set the accessid and accesskey parameters:

name = <collectorName>
accessid = <accessId>
accesskey = <accessKey>

Start the collector:

sudo service collector start

3. Configure a Syslog Source​

  1. In the Sumo Logic web app, select Manage Data > Collection > Collection.
  2. Find the Installed Collector you want to add the source to, click Add, then choose Add Source.
  3. Select Syslog as the source type.
  4. Set the protocol to UDP and choose a port.
  5. Set a Source Category, for example netflow/enriched. You will use this value to scope searches and to configure the NetFlow App.
note

The port number here must match the port you set on the NFO output in the next step.

4. Configure the NFO Output​

In the NFO web interface, select Outputs on the left navigation bar and press the plus sign, then set the following:

ParameterValue
TypeJSON (UDP)
Addresslocalhost if the collector runs on the NFO host, otherwise the IP address of the collector host.
PortThe UDP port configured on the Syslog Source.
Output filterModules output only, so only enriched module output is sent.
nfc_id filterOptional. A comma-separated list of the message types to send, for example 20062 for Network Conversations. Leave empty to send all enabled module output.

5. Verify Data Is Arriving​

In Sumo Logic, open Log Search and run a search scoped to the Source Category you set in step 3:

_sourceCategory=netflow/enriched
| json field=_raw "nfc_id", "src_ip", "dest_ip", "bytes_in"

Messages should appear with nfc_id populated, confirming that NFO output is reaching the collector and that Dynamic Parsing is extracting fields.

To confirm enrichment is working, check for the fields your configuration adds. For example, with VMware or cloud enrichment enabled, src_vm_name and dest_vm_name are populated for flows involving known virtual machines.

6. Install the NetFlow App​

With data arriving, install the pre-built dashboards from the Sumo Logic App Catalog.

  1. In Sumo Logic, go to the App Catalog and search for netflow.
  2. Select the NetFlow Logic app and click Add to Library.
  3. In the configuration wizard, select the Source Category you set on the Syslog Source in step 3, for example netflow/enriched.

Next Step​

The dashboards require two lookup files for protocol names and critical ports. See the NetFlow App Reference for the dashboards included in the app and for the lookup file setup.