Searching Subscriber Statistics by IP Address

The data set to be stored depends on the type of subscriber:

• For a public IP address, exporting Full NetFlow to QoE Stor is sufficient. Configuring export in IPFIX (Netflow 10)
• For a private IP address, additional NAT Flow data collection — translation information — is required. NAT Flow Configuration

• Raw (unaggregated) logs are the full set of IPFIX fields and contain all the details: time, IP addresses, ports, and more. These logs provide information down to the second.
• Aggregated logs are summarized data that is used for reports, such as subscriber or host TOPs. Aggregation groups events by time (for example, every 15 minutes) and removes unnecessary details such as ports. The result is data to analyze over time intervals, without exact timing.

Raw logs are needed for accurate analysis, while aggregated logs are needed for reporting.

In this case, information retrieval is performed on aggregated data. Initially, SSG exports raw data to QoE Stor, and by default, aggregation is performed every 15 minutes. More on changing aggregation and re-aggregation intervals.

Raw unaggregated data is available in the following sections of QoE Analytics in the GUI:

1. Raw Full NetFlow (by default, data is stored for 2 hours)
2. Raw NAT Flow (by default, data is stored for 2 hours, QoE license required)

Aggregated statistics are available in the following sections of QoE Analytics in the GUI:

1. NetFlow (by default, data is stored for 14 days)
2. NAT Flow (by default, data is stored for 14 days), QoE license required)

In the GUI, go to Administrator → GUI Configuration → Settings → QoE Stor: DB lifetime settings:

• For Raw Full NetFlow, select QoE Stor fullflow main log lifetime in hours (1).
• For NAT Flow, select QoE Stor NAT aggregated log lifetime in days (2).

When increasing the data retention period, it's recommended to enable the deletion of old data when the disk fills up: Administrator → GUI Configuration → Settings → QoE Stor: Disk settings → Select Enable force moving data for DEFAULT disk – choose Enable data removing! → Select Move factor for DEFAULT disk – set the value to 0.1.

You can find out how much disk space logs are using in QoE Analytics → Administrator → Reports → Tablespace info.

The ability to view subscriber activity data appears after generating the NAT log — instructions NAT Flow Configuration.
In the GUI, navigate to QoE Analytics → NAT Flow.
In the NAT Flow section, you need to:

1. Select the time period
2. Enable the “Source IPv4-address” and “Destination IPv4-Address” filters (check the box)
3. Enter values for the enabled filters and apply changes

In the GUI, navigate to QoE Analytics → NetFlow.
In the NetFlow section, you need to:

1. Select the time period (by default stored for only 14 days!)
2. Enable the “Subscriber,” “Login,” and “Host IP” filters (check the box)
3. Enter values for the enabled filters and apply changes

In the GUI, navigate to QoE Analytics → Raw Full NetFlow.
In the Raw Full NetFlow section, you need to:

1. Select the time period (by default stored for only 2 hours!)
2. Enable the “Source IPv4-address” and “Destination IPv4-Address” filters (check the box)
3. Enter values for the enabled filters and apply changes