IPFIX File Collectors

How-To Read IPFIX Files

Using fixbuf to read from IPFIX Files as a Collecting Process is very much like the Export case. Create an fbInfoModel_t using fbInfoModelAlloc() and any additional, vendor-specific information elements using fbInfoModelAddElement(), fbInfoModelAddElementArray(), fbInfoModelReadXMLFile(), or fbInfoModelReadXMLData(). Next create an fbSession_t using fbSessionAlloc() and add internal templates via fbSessionAddTemplate(). External templates do not need to be added for collection, as they will be loaded from templates in the file.

Then create an fbCollector_t to encapsulate the file, using the fbCollectorAllocFP() or fbCollectorAllocFile() calls.

With an fbSession_t and an fbCollector_t available, create a buffer for writing via fBufAllocForCollection(). Set the internal template ID with fBufSetInternalTemplate(), and use fBufNext() to read records from IPFIX Messages and Messages from the input stream.

By default, fBufNext() will consume an IPFIX Message from the input stream when the end of the message buffer is reached on read. The fBufSetAutomaticMode() call can be used to modify this behavior, causing fBufNext() to return FB_ERROR_EOM when at end of message. Use this if your application requires manual control of message collection. In this case, fBufNextMessage() will consume a Message from the input stream.