Use Cases
Getting Started
Integrations
Appendix
Flow Logs
What Flowmill Collects
The Flowmill agent collects metrics on a per second per socket basis. These metrics are collected automatically by the eBPF-based kernel collector with no changes required to the code or container images.
Metric
Details
TCP Throughput
Measured by the Linux kernel
TCP Packet Rate
Measured by the Linux kernel
Retransmission Rate / Packet Loss
Measured by the Linux kernel
Connection Failures
"Syn" timeouts based on failure of the TCP handshake
New Socket Rate
Number of new sockets created per second
Average Round Trip Time
Based on kernel TCP transmission estimators
​
​
UDP Throughput
Measured by Linux kernel
UDP Packet Rate
Measured by Linux kernel
UDP Active Connection Rate
Measured by Linux kernel
UDP Kernel Drop Rate
Measured by Linux kernel
​
​
HTTP Success Rate (200)
Supports HTTP 1.0/1.1, unencrypted traffic
HTTP Client Error Rate (400)
Supports HTTP 1.0/1.1, unencrypted traffic
HTTP Server Error Rate (500)
Supports HTTP 1.0/1.1, unencrypted traffic
HTTP Other Rate (100's, 300's, other)
Supports HTTP 1.0/1.1, unencrypted traffic
Average HTTP Latency
Supports HTTP 1.0/1.1, unencrypted traffic
​
​
DNS Response Rate
Based on DNS traffic from each process
Grouping hierarchies provide labels around this data.
Physical Groupings
Physical Groupings
Description
Zone
Physical location
Host
name of the host or node
Address
(ie. container IP if different than host)
Process
Process name from Linux
Logical Groupings
Logical Groupings
Description
Namespace
Grouping mechanism for services. Can be collected from orchestration like Kubernetes
Service
Distributed service / function. Also frequently collected from the orchestration layer if possible
Version
Container / Docker version (or user defined)
Port
L4 port (only common ports are labeled)
Type
Description of how Flowmill dervied the service name.
Copy link
Contents