ebpf-agent: IPFIX Exporter does not retry connection

[PMaynard]

Hi,

What should the default behaviour be for the ebpf-agent when exporting ipfix and the target service is restarted?

Currently, the ebpf-agent will try to transmit messages to the old connection and does not have the logic to re-establish connection to the service. The agent needs to be restarted.

This can be replicated by:

1. starting flowlogs-pipeline
2. EXPORT=ipfix+udp ebpf-agent
3. stop and start flowlogs-pipeline
4. See errors from ebpf-agent

Is this fine? Should I be running it another way? Should there be logic written to retry connection? Should it timeout and exit after being unable to transmit?

[jotak]

Hi @PMaynard ,
The agent IPFIX export feature is not actively maintained. I'd recommend to use either the grpc export, kafka, or the "Direct-FLP" mode (which doesn't require a separate FLP process/deployment).

E.g that will create the simplest possible pipeline, printing flow logs to stdout via "direct-flp" integration with flowlogs-pipeline:

export FLP_CONFIG='{"pipeline":[{"name": "writer","follows": "preset-ingester"}],"parameters":[{"name": "writer","write": {"type": "stdout"}}]}'
export EXPORT="direct-flp"
bin/netobserv-ebpf-agent

[jotak]

@msherif1234 we might add that to the doc... Also wondering if IPFIX should be continued since it's unmaintained (unless we find someone willing to maintain it)

[jotak]

netobserv/netobserv-ebpf-agent#459

[jotak]

Quick update here, as the same issue was also reported with the direct-flp mode : this has been fixed in v1.9.1-community