Load balancers are used to virtualize scale out service pools: clients connect to a virtual IP address and service port associated with the load balancer which selects a member of the server pool to handle the request. This architecture provides operational flexibility, allowing servers to be added and removed from the pool as demand changes.
scalability it offers when request rates are high and conventional logging solutions generate too much data or impose excessive overhead. In addition, monitoring HTTP services using sFlow is part of an integrated monitoring system that spans the data center, providing real-time visibility into application, server and network performance.
Once configured, BIG IP will stream measurements to a central sFlow Analyzer. Download, compile and install the sflowtool on the system your are using to receive sFlow to see the raw data and verify that the measurements are being received.
Running sflowtool will display output of the form:
startDatagram ================= datagramSourceIP 10.0.0.153 datagramSize 564 unixSecondsUTC 1370017719 datagramVersion 5 agentSubId 3 agent 10.0.0.153 packetSequenceNo 16 sysUpTime 1557816000 samplesInPacket 2 startSample ---------------------- sampleType_tag 0:2 sampleType COUNTERSSAMPLE sampleSequenceNo 1 sourceId 3:2 counterBlock_tag 0:2201 http_method_option_count 0 http_method_get_count 71 http_method_head_count 0 http_method_post_count 0 http_method_put_count 0 http_method_delete_count 0 http_method_trace_count 0 http_methd_connect_count 0 http_method_other_count 2 http_status_1XX_count 0 http_status_2XX_count 26 http_status_3XX_count 24 http_status_4XX_count 23 http_status_5XX_count 0 http_status_other_count 0 endSample ------------------- startSample ------------------- sampleType_tag 0:1 sampleType FLOWSAMPLE sampleSequenceNo 1 sourceId 3:2 meanSkipCount 1 samplePool 1 dropEvents 0 inputPort 352 outputPort 1073741823 flowBlock_tag 0:2102 extendedType proxy_socket4 proxy_socket4_ip_protocol 6 proxy_socket4_local_ip 10.0.0.153 proxy_socket4_remote_ip 10.0.0.150 proxy_socket4_local_port 40451 proxy_socket4_remote_port 80 flowBlock_tag 0:2100 extendedType socket4 socket4_ip_protocol 6 socket4_local_ip 10.0.0.153 socket4_remote_ip 10.0.0.70 socket4_local_port 80 socket4_remote_port 40451 flowBlock_tag 0:2206 flowSampleType http http_method 2 http_protocol 1001 http_uri /index.html http_host 10.10.10.250 http_referrer http://asdfasdfasdf.asdf http_useragent curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/184.108.40.206 zlib/1.2.3 libidn/1.18 libssh2/1.2.2 http_authuser Aladdin http_mimetype text/html; charset=UTF-8 http_request_bytes 340 http_bytes 8778 http_duration_uS 1930 http_status 200 endSample ---------------------- endDatagram ======================There are two types of sFlow record shown: COUNTERSAMPLE and FLOWSAMPLE data. The counters are useful for trending overall performance using tools like Ganglia and Graphite. Using sflowtool to output combined logfile format makes the data available to most logfile analyzers.
Note: The highlighted IP addresses in the FLOWSAMPLE correspond to addresses in the diagram and illustrate how request records from the proxy link clients to the back end servers.A native sFlow analyzer like sFlowTrend can combine the counters, flows and host performance metrics to provide an integrated view of performance.
Apache, NGINX, Tomcat and node.js. Application logic running on the servers can also be instrumented with sFlow, see Scripting languages. Back end Memcache, Java and virtualization pools can also be instrumented with sFlow. sFlow agents embedded in physical and virtual switches provide end-to-end visibility across the network.
Comprehensive visibility in multi-tiered environments allows the powerful control capabilities of the load balancers to be used to greatest effect: regulating traffic between tiers, protecting overloaded backend systems, defending against denial of service attacks, moving resources from over provisioned pools to under provisioned pools.