Collecting statistics from interfaces using pfstat

For the PF firewall, there is a handy tool for creating graphs of the load on the interfaces, pfstat . It is available in * bsd .
To install this utility will take quite a bit of time.


Installation:

cd / usr / ports / sysutils / pfstat && make install
')
After installation, you need to create a config for the program:

ee /etc/pfstat.conf

with the following content:

## Bytes in and out plus states
#
collect 1 = interface "ae0" pass bytes in ipv4 diff
collect 2 = interface "ae0" pass bytes out ipv4 diff
collect 3 = global states entries

image "/usr/local/www/nginx/pfstat_day.jpg" {
from 1 days to now
width 980 height 200
left
graph 1 "in" "bytes / s" color 0 192 0 filled,
graph 2 "out" "bytes / s" color 0 0 255
right
graph 3 "states" "entries" color 192 192 0
}

image "/usr/local/www/nginx/pfstat_week.jpg" {
from 1 weeks to now
width 980 height 200
left
graph 1 "in" "bytes / s" color 0 192 0 filled,
graph 2 "out" "bytes / s" color 0 0 255
right
graph 3 "states" "entries" color 192 192 0
}

image "/usr/local/www/nginx/pfstat_month.jpg" {
from 1 months to now
width 980 height 200
left
graph 1 "in" "bytes / s" color 0 192 0 filled,
graph 2 "out" "bytes / s" color 0 0 255
right
graph 3 "states" "entries" color 192 192 0
}
I will not describe the config, everything is primitively clear, you need to set the interface with which the statistics are taken,
packs where they put the finished images and, respectively, the colors of the information collected.

Further, after saving the config, you need a web server to display the information, I used nginx

cd / usr / ports / www / nginx && make install

after installation run nginx

/usr/local/etc/rc.d/nginx start

Next, add the following to cron:

* * * * * root / usr / local / bin / pfstat -q -d /var/db/pfstat.db -c /etc/pfstat.conf
* / 5 * * * * root / usr / local / bin / pfstat -p -d /var/db/pfstat.db -c /etc/pfstat.conf
25 3 * * * root / usr / local / bin / pfstat -t 30 -d /var/db/pfstat.db -c /etc/pfstat.conf

these records mean collecting statistics every minute, generating an image every 5 minutes,
clear statistics once a month.

Sample statistics: