Five posts on NetFlow v9 from Cisco IOS XE into open source collectors: Akvorado setup and top talkers, the double-counting trap, Akvorado vs GoFlow2 with matching byte totals but 2.4 GiB vs 146 MiB, scan detection, and pmacct to CSV and SQL.
Nine Zabbix 7.0.32 LTS posts for Cisco IOS XE networks: SNMPv3 onboarding, agent 2, a Grafana NOC board, triggers that cut one outage from six problems to two, escalation, syslog and traps, API onboarding, and database housekeeping.
Ten Grafana 13.0.2 posts for Cisco IOS XE monitoring: SNMPv3 with snmp_exporter, syslog in Loki, a gNMI support check, alerting with real emails, NetFlow, node_exporter, blackbox probes, dashboards as code, and a NOC wall screen.
Suricata 8.0.3 and Zeek 9.0.0 on a mirrored management network, logs shipped by Alloy into Loki, and one Grafana alert for anything outside the NOC touching the routers. A threshold change cut a 100-port scan from 7 alerts to 1.
Netdisco 2.117001 found two IOS XE routers and a switch from one CDP seed in about a minute, over SNMPv3, and resolved an IP to its MAC and port from 18 ARP entries. Host tracking stayed empty: the switch had no access-port hosts.
LibreNMS 26.10.2 and Zabbix 7.0.32 on the same three IOS XE devices and SNMPv3 user. LibreNMS graphed everything from one subnet scan; Zabbix flagged a BGP shutdown in 59 seconds against about five and a half; idle memory was 338 MiB vs 873 MiB.
One IOS XE change through seven open source tools: intent in NetBox, a Batfish check, an Ansible push with changed=0 on re-run, an Oxidized Git commit 30 seconds later, and the new description in Loki, Zabbix, and Akvorado.
NetBox 4.7.4 as the live Ansible inventory for Cisco IOS XE: load the lab from Git, build groups with nb_inventory, and push interface descriptions. Check mode showed two commands, the apply fixed the drift, and the re-run reported changed=0.
Batfish modeled IOS XE configs offline and caught a shadowed ACL line and a Null0 static that would have dropped a LAN, before anything touched a device. All three configs parsed only partially, with 23 warnings, which you need to read first.
Oxidized 0.37 pulls Cisco IOS XE running configs into Git on a schedule. A three-device setup with one container, what remove_secret masks and misses, and the first real diff, which caught a description pointing at the wrong neighbor.
nfacctd turns Cisco IOS XE NetFlow v9 into per-minute CSV files and SQLite rows on the keys you choose. Against Akvorado on the same export, ten-minute totals differed by 1.7% and 5.2%, and the reason is time binning, not lost flows.
A port scan is invisible in bandwidth graphs: 0.00 pps in Akvorado. Counting distinct ports and hosts per source in ClickHouse found a 120-port scan and a 40-host ping sweep from Cisco IOS XE NetFlow v9, plus an open-port list for the target.