6.2. Custom counter groups

6.2.1 Filtered counter groups

A cross-product counter group.

Meter a subset of a group that matches a set of keys from another group.

Uses

Filtered counter group are invaluable in setting up cross-group counters.

Some examples :

Create new filtered counter groups

1. Click the button “New Filtered Counter Group”
2. You will be redirected to a page with following fields

Custom group

For more advanced custom counters you can use the LUA API to measure any subset of metrics

6.2.2 Keyset counter groups

A new counter group that aggregates sets of keys from a host counter group. Essentially monitors a “group of keys” as a single key.

Use cases

Multiple constraints

If you want to create multiple constraints then consider Rule Set Counter Groups

Creating a Keyset Counter Group

Important Restart Trisul for the new counter group to take effect

Create new keyset

Directions to Create new keyset counter groups

1. The list of keyset counter groups will appear
2. Click the option found at the bottom section Add new Keyset Counter Group
3. You will be redirected to a page with following fields

On successful creation , you will be redirected to the List of keyset counter groups

1. Click the Edit Keys to edit keysets for counter group
2. You will be redirected to a page with following fields

6.2.3 Stat based counter groups

A new counter group consisting of items based on an observed meter value.

Usage

Creates a subset of a parent group consisting only of items who meet a certain meter criteria.

Examples :

Creating new Meter Value Counter Group

1. The list of Configure Statval Counter Groups will appear
2. Click the option found at the bottom section New Counter Group Statval
3. You will be redirected to a page with following fields

6.2.4 Rule Based counter groups

A rule based counter group allows you the maximum flexibility to custom-meter your network traffic.

It works like this :

1. Derive from a parent group such as hosts / applications / macs
2. Specify a chain of rules in Trisul Filter Format
3. The first rule that matches determines the meter key
4. If no rule matches the key falls through to the parent counter group

An example : Corporate applications

You are a network admin in an enterprise and wish to meter traffic in terms of your applications.

Here are your requirements.

You would specify the rules as follows

Counter Group Name : ACME APPS
Parent Group : Applications (guid = {})

Creating a Rule Based Counter Group

Directions to create a new Rule Based Counter Group
p(autohint hand-o-right info).

Login as Admin → Select Context and profile → Under Custom Counters → Rule Based

1. Click the option Create new rule based counter group

This leads you to a page , whose fields are explained below

After creation , the user is redirected to a page which lists the available rule based counter groups

Now click the Edit Rules option for the counter group , which leads you o another page , whose fields are as follows

Specifying a target rule

{4CD742B1-C1CA-4708-BE78-0FCA2EB01A86}=80.79.32.7A&{C51B48D4-7876-479e-B0D9-BD9EFF03CE2E}=p-0050

The above rule tracks the activities of the key 80.79.32.7A only for HTTP application

6.2.5 Cardinality counting

Cardinality counters allow you to measure unique hits for keys within a counter group. For example, we can track how many unique IPs did each country see.

By default, Trisul ships with the following three cardinality counters enabled.

You may add your own cardinality counters to any counter group with the following restriction :

1. A maximum of 2 cardinality counters are allowed per counter group.

Creating cardinality counters

Login as Admin → Select Context and profile → Under Custom Counters → Cardinality

1. A list of existing counters is displayed
2. Click on New Cardinality Counter
3. Enter the following three fields

Example

If you wanted a cardinality counter to count unique hosts for each country.

1. Host Counter Group = Country from dropdown
2. Cardinality Counter Group = Hosts from dropdown
3. Description = Unique Hosts

Using cardinality counters

Once configured, cardinality counters behave just like other counters. They appear as extra counters in the drop down lists, you can draw charts, trend over time, even set threshold crossing alerts on them.

6.2.6 Cross Key Counter groups

This lets you monitor a cross product of two or three counter groups. This takes advantage of the fact that Trisul is capable of monitoring millions of unique keys for any counter group. By crossing the Applications X Hosts counter group you setup a new counter group with Unique(hosts) x Unique(apps) keys.

Example 1 : Two Groups Host flows

Say you want to see Internal Hosts to External Host traffic flows – you can get this by querying the Flows database using the Explore Flows tool, but this is impractical for large deployments which can have billions of flows. To solve this we setup a Cross Key Counter group of Internal Host x External Hosts

Using the normal Retro Counters tool you can see the composite keys

Example 2 : Three Groups Hosts App flows

You can cross 3 groups as well. Here we setup a new Cross Keys counter group with Internal Hosts X Applications X External Hosts

Creating a Cross Key counter group

1. Click the option New Crosskey Counter Group

This leads you to a form with these five fields.

After creation , the user is redirected to a page which lists the newly created group.

Viewing

Once created , the new Cross Key counter group is just like any other group.

The cross key counter group is intended for visualizing relationships as Flows. You can use the Sankey Crosskey Trisul APP to visualize the cross key counter group.