Overview

Important

The views/pages included in the Classic UI’s Status tab, including all the information they provide, have been integrated into the Monitor, Explore, Investigate, and Reports tabs of the updated Plixer Scrutinizer UI. To learn more about upgrading to the latest version of Plixer Scrutinizer, see the Updates and upgrades section of this documentation.

Interfaces

The Top Interfaces is the default view of the Status tab unless it is modified by the user by editing their profile. Be sure to mouse over items on this page before clicking as the tool tip that appears can be very helpful. The columns of this table of interfaces includes:

• Checkbox: Check off the interfaces desired to include in a single report and then click the trend icon at the top of this column.
  

• Icon color status: The color is determined by CrossCheck. Mousing over the icon will provide polling details.
  

• Flow Version: Clicking on the version of flows received (e.g. N9, N5, I10) opens a report menu for the device which includes a Flow Stats report for the device.
  

• Interface: Clicking on the Interface will open the Report menu. Selecting a report from here will run an inbound/outbound (bidirectional) report for the last 24 hours in 30 minute intervals. The user can drill down from there.

• Arrow down menu: Clicking this presents a menu:

  • Reset the high watermark(s) in the Inbound/Outbound columns

  • Interface Details

  • Device Overview

• Inbound/Outbound: these columns represent utilization over the last 5 minutes. Clicking on them will prompt the user to run a report for the last 5 minutes in 1 minute intervals.

Menus

The Status tab is one of the most popular views for gaining quick access to all the NetFlow capable devices and interfaces that are represented in the flows received. The default view is a list of all flow sending interfaces however, this can be modified under Admin tab > Security > User and then click on a user. Click on Preferences in the modal and find the “Default Status View” and choose from one of several opitons.

Gear

• Select how many interfaces should be displayed before utilizing the pagination.
  

• Decide whether the interfaces should be listed by highest percent utilization or by highest bit, byte or packet rate.
  

• The refresh rate of the top interfaces view.
  

• Toggle between IP/DNS depending on how the flow devices should be listed.

Top Right icons (mouse over for tool tips) are for:

• Primary Reporting Server: Indicates if the server is a primary server or a collector.

• Scrutinizer Server Health: View the system vitals of the server. Find out where the system needs resources.

• Scrutinizer Software Health: View the status of the system components.

• Exporter Health: View a list of flow exporters. Find out which devices are under performing.

• Magnifying Glass: Search for a specific IP address.

• Down Arrow:

• Scrutinizer Version: The current version the server is running on.

• Check for Updates: Connects to Plixer to see if updates are available.

• Contact Support: Launches a web page to contact Plixer for support.

• Online Help: Launches this manual!

• Manage Exporters: Launches > Admin tab > Definitions > Manage Exporters to see what devices are sending flows to the collector(s).

• Join the beta program: Fill out a form online to join the beta program.

• Log Out: Log out of Scrutinizer

Top Right icons below logout are for:

• Clock: Schedule a reoccuring email of the top interfaces view.
  

• @: Email on demand the current interfaces view.
  

• PDF: Create a PDF on the current interfaces view.
  

• CSV: Export a CSV file containing the content of the current interfaces view.

Top menus along the top include:

• Run Report: Need to design a custom report? Select from all available elements, operation columns, devices, and time ranges to get the exact data needed.

• Top: Not sure what report to run? Select from over a dozen canned reports that will include data from all flow exporters.

• Search: Need to find a host or IP address?

  • Host Index: Run a report by “Host Index” to quickly determine if the host has ever been on the network. It searches the index rather than the saved flows. This search requires that Host Indexing be turned on in Admin>Settings>System Preferences.

  • Saved Flows: Run a search against all “Saved Flows”. This search actually queries the database and can take a bit longer. NOTE: Depending on archive settings, the desired data may have been dropped. This search is more flexible and allows for searching by host address, username, wireless host or SSID across some, or all, flow exporters for a specified timeframe.

• System: These are advanced reports used by engineering when trying to understand why something isn’t working. In a future release, they will be moved to the Admin tab.

  • Available Reports: Lists the report and the number of templates received that contain the necessary elements.

  • Flow Report Thresholds: Lists all the reports that have been saved with a threshold.

  • Templates: These display the device and each flow (NetFlow v9/IPFIX) template exported from that device.

  • Vitals: These are reports on the system resources from the flow collection and reporting servers.

• Views:

• CrossCheck

• Device Status: Lists all of the flow sending devices with corresponding details. The color of the icons is determined by CrossCheck.

• Interfaces: This is the default view of the status tab before a report is run.

• SLA: Lists all of the flow sending devices which by default are being pinged by the collector. The response from each ping is used to determine the Response times and availability for each device polled.

• Usernames: This view displays any username information collected from exporters such as Cisco ASA, SonicWALL firewalls, or authentication servers such as Active Directory, RADIUS, etc.

• Vendor Specific: lists reports that will work ONLY if the collector is receiving the necessary templates from the flow exporters.

Left hand side menus provide three views:

• Device Explorer: Displays a list of all the Groups of devices. Explained below.

• Current Reports: Displays the current report after a report is run on one or more interfaces. Explained below.

• Saved: Displays all of the saved filters/reports that can be run. Explained below.

Device explorer

Organize devices by moving them into groups.

• New: used to create groups / maps of devices that are currently in ‘Ungrouped’. A device can be a member of multiple groups.

• Groups:

• Ungrouped: By default all flow exporting devices are placed in Ungrouped until they are moved into one or more user created groups.

• Grouped: A group of devices that typically share one or more attributes.

• View: Displays the map for the devices in the group.

• Reports: Select a report to run against all of the flows collected from all the devices in this group.

• Copy: Make a copy of the group and give it a new name.

• Modify: Modify the membership of the objects in the group.

• CrossCheck: View CrossCheck for the devices in this group.

• SLA: View the Service Level Report for the flow exporting devices in this group.

• Show Interfaces: Show all active interfaces for the flow exporting devices in this group. The interface list will display in the main window of this screen.

• Exporters: Devices that are exporting flows show up in the left column. The color of the icon represents the selected primary status for the object. The sub icon represents the Fault Index value for the device in CrossCheck. Expand the flow exporter for the menu.

• Reports: Run a report on the flows coming from the device. Select a report to display flow data. Selecting a report from here will run the report for ALL interfaces of the device resulting in the inbound traffic matching the outbound traffic. For this reason, this report is displayed inbound by default.The default timeframe for this report is Last 24 hours in 30 minute intervals.

• Interfaces: Displays a list of interfaces for the device. Click on an interface to run a report. Selecting an interface (or All Interfaces) from this list will open a report menu. Select and run a report for the last 24 hours. ALL Interfaces reports will default to Inbound as described above, selecting a single interface will report on both Inbound and Outbound.

• Properties: Modify the properties of the device.

• Device Overview: Provides the overall status of the device by leveraging data from CrossCheck, the poller and the alarms.

• Show Interfaces: Displays a list of all active interfaces for the device in the main window of the page.

• Other Options:

  • Alarms: Displays the outstanding alarms for the device.

  • Interface Details: launches the Interface Details view which lists SNMP details about the device including the interface speeds.

  • Flow Templates (Advanced): displays the templates (e.g. NetFlow v9, IPFIX, etc.) currently being received from the device.

Current report

This tab opens when a report is selected from the report menu. All of the icons that appear in the top left are explained in Network Traffic Reporting.

Filters can be added to the report by grabbing items in the table and dragging them to the left or by clicking on the “Filters / Details” button.

Saved reports

Saved reports are saved filters or reports which display the selected data on one or more interfaces across potentially several devices. When Saved is clicked the user is returned to the Current Report view and the filter contents are displayed.

This tab lists any reports that were saved and provides folder management utilities:

• Add Folder: Select ‘Add Folder’. A text box will open to enter a folder name which is used for organizing saved reports.

• Manage Folders: Select ‘Manage Folders’. A new browser tab will open to Admin > Reports > Report Folders. From here, bulk folder/saved report management can be accomplished by moving several reports in and out of a folder. New folders can be created or deleted from here.

• Saved reports list: Following the list of report folders (if any) will be the list of any reports that have been saved. Each saved report has two icons:

• Trash can: to delete the saved report. Deleting the report will also delete any dashboard gadgets or scheduled reports associated with this saved report.

• Magnifying glass: hovering over this icon will open a tooltip providing the parameters that the report was saved with, such as who created the report, the date range of the report and other information defining this report. Also included at the top of the tooltip is the Report ID, which is required for some advanced functions.

Report folder management is also available from within the Saved reports tab by dragging and dropping the reports into or pulling them out of the desired folders. Reports can be viewed by clicking on the report name. They can also be renamed once the report is in view mode by editing the report name and clicking the Save icon. The dynamic filter just below the Saved reports header allows the user to easily find reports within the report list or folders.