Configuring Riverbed NetProfiler

What Riverbed NetProfiler is and why configuration matters

Riverbed NetProfiler provides hybrid flow monitoring, analysis, and reporting for all flow types. When you add it as a data sourceClosed A product in your network that forwards data to the system. This data can be streaming data used to detect anomalies and generate incidents, or data that can be fetched on demand when runbooks are executed. in Riverbed IQ Ops, that data flows through Riverbed Edge into the platform and feeds analytics, incidentsClosed A collection of one or more related triggers. Relationships that cause triggers to be combined into incidents include application, location, operating system, or a trigger by itself., and runbooks.

Before you can add NetProfiler as a data source, you must configure the NetProfiler system so it can communicate with Riverbed Edge and:

  • Install a supported version.

  • Create a dedicated user with the operator role.

  • Ensure host group definitions (ByLocation) are complete so IQ Ops can monitor application performance by client and server group.

Without this setup, you cannot connect NetProfiler in Riverbed IQ Ops, and you will miss flow-based insights and incidents for that scope.

What you need before you start

This topic only covers the configuration you do in the NetProfiler web UIClosed User Interface. The visual components and controls that users interact with to access features and manage the system.. You will also add and configure NetProfiler as a data source in Riverbed IQ Ops afterward. That procedure is described in Adding a Data Source.

  • Riverbed Edge must be configured and deployed. If you have not done that yet, or need to revisit it, see Configuring Riverbed Edge and Data Sources. You will use the NetProfiler user credentials when you add NetProfiler as a data source on the Edge.

  • Access to the NetProfiler web UI with rights to create users and manage definitions (e.g. host group types).

  • Repeat the steps in this topic for each NetProfiler system you want to use as a data source.

Install NetProfiler and create a user

The Edge connects to NetProfiler using a dedicated user account. Install a supported NetProfiler version, then create a local user with the operator role. You will use that user when you add NetProfiler as a data source in Riverbed IQ Ops.

To install and create the user:

  1. Go to the Riverbed Technology support site and install the latest supported version of NetProfiler (e.g. GA 10.24.2).

  2. In the NetProfiler UI, create a new local user and assign the role operator.

Configure and verify host group definitions

IQ Ops monitors how applications are performing for each configured ByLocation host group. If there are ungrouped hosts, that traffic is not monitored and you can miss incidentsClosed A collection of one or more related triggers. Relationships that cause triggers to be combined into incidents include application, location, operating system, or a trigger by itself.. Ensure ByLocation host group definitions are complete and that server and client groups cover the traffic you care about.

To configure and verify host groups:

  1. In the NetProfiler UI, go to Definitions > Host Group Types and review the ByLocation host groups.

  2. Go to Reports > Traffic and run a host groups report.

  3. Export the Server Host groups table and the Client Host groups table to CSV and check the results. Confirm that server and client groups are returned as expected.

  4. In the CSV, all groups together should account for 100% of the traffic. The Others row is ungrouped traffic; IQ Ops does not monitor it and you may miss incidents. If the Others row is present and has a large value, go to Definitions > Host Group Types, edit the ByLocation definitions, then re-run the report and export to CSV until the Others traffic is reduced.

  5. To find ungrouped hosts, run a Traffic Hosts report and look for hosts not assigned to a group.

  6. Sort on the Group column; unassigned hosts appear at the top.

  7. Update Definitions > Host Group Types (ByLocation) so that previously ungrouped hosts are included in the appropriate groups, then re-run reports to verify.

Note: The Traffic report is limited to 10,000 hosts. On larger networks you may not see all hosts, but you will see the top 10,000 talkers.

Add NetProfiler as a data source in Riverbed IQ Ops

After you complete the steps above for each NetProfiler system, add and configure each one as a data source in Riverbed IQ Ops. For the procedure, see Adding a Data Source.