Understanding Backends and Packages
NFR captures network packets and passes them to the NFR engine for evaluation. The
engine decides where to direct the packets based upon the selection criteria previously
established in the filter. The data is then sent to the appropriate "backend".
Backends
A backend is not one specific object, but rather consists of several components:
- A filter, written in N code, that is loaded by NFRD and that will run the recorder. The
filter examines incoming packets and decides if any of the data should be recorded. If so,
it sends that data to the "recorder". The data is sent as a record with a fixed
set of fields which is similar to a row of a database table.
- The "recorder" writes the records into files. Special processing may occur
depending on the type of backend you are using. The data is then stored in the files.
- The user interface can display the recorded data by making "queries" to the
backend. A query describes a subset of the data to be displayed. The display output will
depend upon the type of backend that is being queried.
NFR provides are two types of backends: List and Histogram. A List backend collects details about individual
events; a Histogram backend collects statistical data.
Some backends can send alerts on
various conditions.
Packages
A package is a collection of backends. Each backend has N code of its own, but there is
also a piece of N code that is shared by all the backends in a package.
There are two good reasons to group backends into packages:
- The backends may all be recording data you consider to be related. It could be
convenient to group them.
- If several backends process the same data, you can combine them into a package for
efficiency. For example, you could call the same program to run once in a package rather
than running multiple copies for each backend.
NFR includes several packages that allow you to monitor mail, network, and Web traffic.
|