Thursday 27 April 2017

Running sFlowTrend in a Docker container

sFlowTrend is now available as a Docker image. Docker makes it really easy to try out sFlowTrend, and you can also use it as a convenient way to run it in production. It will work for both the free sFlowTrend, or for sFlowTrend-Pro - just select the free option, or enter your license number in the System Configuration>License dialog.

To run sFlowTrend in Docker, use the command

docker run -v /var/local/sflowtrend-pro:/var/local/sflowtrend-pro -p 6343:6343/udp -p 8087:8087 -p 8443:8443 -h sflowtrend-pro -e TZ=Europe/London -d --restart unless-stopped sflow/sflowtrend

This will run the latest version of sFlowTrend. You can select a specific version using the appropriate tag, e.g. sflow/sflowtrend:6.5.04. See the docker hub repository at for more information on the versions available. Some explanation of the command line options used is worthwhile:
  • -v /var/local/sflowtrend-pro:/var/local/sflowtrend-pro mounts the specified directory on the host at /var/local/sflowtrend-pro in the container. This means that the data and configuration will be persistent, and available in this location. Instead of this, you could optionally use a Docker volume, in which case the persistent data would be in the volume. If you don't specify the volume, the data will be lost from one container to the next - this might be OK for evaluation purposes.
  • -p 6343:6343/udp -p 8087:8087 -p 8443:8443 publishes the required network ports. You can map the ports used in the container to something different on the host if you like. UDP port 6343 is the sFlow port, and if you use something else then your network infrastructure would need to be configured to send sFlow on the new port. Port 8087 is used for the http connection for the sFlowTrend web client, and port 8443 for the https connection; if you change these, then the new port would need to specified in the web browser you are using to connect to sFlowTrend.
  • -h sflowtrend-pro sets the hostname of the container. This is important if you are using sFlowTrend-Pro: you would need to use the hostname that matches your license. The hostname is also shown on the dashboard.
  • -e TZ=Europe/London sets the timezone of the container. All data in sFlowTrend is shown in this timezone, so it is important that you set it correctly for your location. You can use a standard Linux timezone identifier here.
  • -d runs the container in the background.
  • --restart unless-stopped automatically starts the container when the Docker engine starts.
When you first run sFlowTrend in Docker, the latest version will be pulled from the Docker hub. After this, because it is cached locally, on future runs it will run the same version. If a new version of sFlowTrend has been released, you can force this to be downloaded using the command
docker pull sflow/sflowtrend

Configuring sFlow using SNMP in a container

sFlowTrend has the ability to configure sFlow on some switches using SNMP. This works with only a few vendors devices, but can be easier than using the CLI on the switch to set up sFlow. If you are using SNMP to configure sFlow with sFlowTrend in a Docker container, then you have to ensure that sFlowTrend knows the correct address to use for sFlow data. This is because, using the default Docker network (bridge), the container is effectively run behind a logical NAT device. The easiest way to set this up is to first run the container as above, and then stop it after 10 seconds or so; this will create the file structure and empty configuration file in /var/local/sflowtrend-pro. Then follow the instructions for the configuration option sflowtrend.natReceiverAddress at

When you run the container a second time, the address you entered will be available in the System Configuration option for the sFlow receiver address. Select this, and the sFlow data should be directed to that address.