What Flowmill Collects

The Flowmill agent collects metrics on a per second per socket basis. These metrics are collected automatically by the eBPF-based kernel collector with no changes required to the code or container images.

Metric

Details

TCP Throughput

Measured by the Linux kernel

TCP Packet Rate

Measured by the Linux kernel

Retransmission Rate / Packet Loss

Measured by the Linux kernel

Connection Failures

"Syn" timeouts based on failure of the TCP handshake

New Socket Rate

Number of new sockets created per second

Average Round Trip Time

Based on kernel TCP transmission estimators

UDP Throughput

Measured by Linux kernel

UDP Packet Rate

Measured by Linux kernel

UDP Active Connection Rate

Measured by Linux kernel

UDP Kernel Drop Rate

Measured by Linux kernel

HTTP Success Rate (200)

Supports HTTP 1.0/1.1, unencrypted traffic

HTTP Client Error Rate (400)

Supports HTTP 1.0/1.1, unencrypted traffic

HTTP Server Error Rate (500)

Supports HTTP 1.0/1.1, unencrypted traffic

HTTP Other Rate (100's, 300's, other)

Supports HTTP 1.0/1.1, unencrypted traffic

Average HTTP Latency

Supports HTTP 1.0/1.1, unencrypted traffic

DNS Response Rate

Based on DNS traffic from each process

DNS Error Rate

Based on DNS traffic from each process

Average DNS Latency

Based on DNS traffic from each process

Grouping hierarchies provide labels around this data.

Physical Groupings

Physical Groupings

Description

Zone

Physical location

Host

name of the host or node

Address

(ie. container IP if different than host)

Process

Process name from Linux

Logical Groupings

Logical Groupings

Description

Namespace

Grouping mechanism for services. Can be collected from orchestration like Kubernetes

Service

Distributed service / function. Also frequently collected from the orchestration layer if possible

Version

Container / Docker version (or user defined)

Port

L4 port (only common ports are labeled)

Type

Description of how Flowmill dervied the service name.