{"id":18830527,"url":"https://github.com/cmu-sei/ansible-role-yaf","last_synced_at":"2026-05-16T08:43:23.533Z","repository":{"id":41966727,"uuid":"276397273","full_name":"cmu-sei/ansible-role-yaf","owner":"cmu-sei","description":"An ansible role for installing, configuring, and managing the YAF service.","archived":false,"fork":false,"pushed_at":"2024-04-03T15:04:01.000Z","size":48,"stargazers_count":1,"open_issues_count":1,"forks_count":0,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-05-29T16:11:44.687Z","etag":null,"topics":["ansible","centos","infrastructure","ipfix","netsa","redhat","role","ubuntu"],"latest_commit_sha":null,"homepage":"https://tools.netsa.cert.org/yaf/docs.html","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/cmu-sei.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2020-07-01T14:18:54.000Z","updated_at":"2023-01-19T00:00:39.000Z","dependencies_parsed_at":"2024-12-30T06:42:44.977Z","dependency_job_id":"378f38ba-6cac-4dc7-9e32-410fe2905543","html_url":"https://github.com/cmu-sei/ansible-role-yaf","commit_stats":null,"previous_names":[],"tags_count":6,"template":false,"template_full_name":null,"purl":"pkg:github/cmu-sei/ansible-role-yaf","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cmu-sei%2Fansible-role-yaf","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cmu-sei%2Fansible-role-yaf/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cmu-sei%2Fansible-role-yaf/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cmu-sei%2Fansible-role-yaf/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/cmu-sei","download_url":"https://codeload.github.com/cmu-sei/ansible-role-yaf/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cmu-sei%2Fansible-role-yaf/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":266058467,"owners_count":23870155,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ansible","centos","infrastructure","ipfix","netsa","redhat","role","ubuntu"],"created_at":"2024-11-08T01:49:21.011Z","updated_at":"2026-05-16T08:43:18.513Z","avatar_url":"https://github.com/cmu-sei.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"yaf\n=========\n\nA role for installing, configuring, and managing the YAF service.  YAF is Yet Another Flowmeter. It processes packet data from pcap dumpfiles as generated by tcpdump or via live capture from an interface using pcap into bidirectional flows, then exports those flows to IPFIX Collecting Processes or in an IPFIX-based file format. YAF's output can be used with the SiLK flow analysis tools, super_mediator, Pipeline, and any other IPFIX compliant toolchain. See yaf [documentation](https://tools.netsa.cert.org/yaf/docs.html) for more information.\n\nRole Variables\n--------------\n\nAvailable variables are listed below, along with default values (see [defaults/main.yml](defaults/main.yml)):\n    \n    yaf_version\n\nThe version of yaf to install.  The master branch will always point to the latest available version.\n\n    netsa_url: \"http://tools.netsa.cert.org/releases/\"\n    yaf_name: \"yaf-{{ yaf_version }}\"\n    yaf_tgz: \"{{ yaf_name }}.tar.gz\"\n    yaf_url: \"{{ netsa_url }}{{ yaf_tgz }}\"\n    yaf_timeout: 10\n    yaf_checksums:\n      '2.11.0': sha256:5e2523eeeaa5ac7e08f73b38c599f321ba93f239011efec9c39cfcbc30489dca\n      '2.10.0': sha256:ed13a5d9f4cbbe6e82e2ee894cf3c324b2bb209df7eb95f2be10619bbf13d805    \n    yaf_checksum: '{{ yaf_checksums[yaf_version] }}'\n\nHelper variables used to download the yaf release from the [netsa tools site](https://tools/netsa.cert.org).\n\n    yaf_myname: \"yaf\"\n\nThe name of the yaf process.\n\n    yaf_conf_template: \"yaf.conf.j2\"\n    yaf_conf_file_loc: \"/usr/local/etc\"\n    yaf_conf_file_path: \"{{ yaf_conf_file_loc }}/{{ yaf_myname }}.conf\"\n    yaf_init_template: \"yaf.j2\"\n    yaf_init_file_path: \"/etc/init.d/{{ yaf_myname }}\"\n\nTemplate sources to use and their destinations.\n\n    yaf_prefix: \"/usr/local\"\n\nFolder prefix for autoconf stuff.\n\n    yaf_service: False\n\nWhether to start the yaf service.\n\n| Variable  | Explanation |\n| ------------- | ------------- |\n| yaf_cap_type: \"pcap\" | Live capture type. Must be pcap, or dag for Endace DAG if YAF was built with libdag, napatech if YAF was built with libnapatech, or netronome with Netronome support |\n| yaf_cap_if: \"eth0\" | Live capture interface name. |\n| yaf_ipfix_proto: \"tcp\" | IPFIX transport protocol to use for export. Must be one of tcp or udp, or sctp if fixbuf was built with SCTP support or spread if fixbuf was built with Spread support.  If using spread, --groups must be added to extra flags |\n| yaf_ipfix_host: \"localhost\" | Hostname or IP address of IPFIX collector to export flows to. |\n| yaf_ipfix_port: \"\" | If present, connect to the IPFIX collector on the specified port. Defaults to port 4739, the IANA-assigned port for IPFIX |\n| yaf_rotate_location: \"\" | If present, and YAF_IPFIX_PROTO is not present, write IPFIX files to the given file directory |\n| yaf_rotate_time: 120 | Rotate time. If present, and YAF_ROTATE_LOCATION is present, rotate files every YAF_ROTATE_TIME seconds. |\n| yaf_statedir: \"/var/log/yaf\" | Path to state location directory; contains the log and pidfiles unless modified by the following configuration parameters. |\n| yaf_pidfile: \"{{ yaf_statedir }}/yaf.pid\" | Path to PID file for YAF |\n| yaf_log_folder: \"{{ yaf_statedir }}/log\" | Folder to create to hold yaf logs. |\n| yaf_log: \"{{ yaf_log_folder }}/yaf.log\" | File or syslog facility name for YAF logging. If file, must be an absolute path to a logfile. Directory must exist. |\n| yaf_user: \"\" | If present, become the specified user after starting YAF |\n| yaf_extraflags: \"--silk --ip4-only\" | Additional flags to pass to the YAF process. Use --silk --ip4-only for export to SiLK v2 rwflowpack or SiLK v2 flowcap. |\n\nDependencies\n------------\n\n- cmusei.silk\n\nExample Playbook\n----------------\n\n    - hosts: servers\n      vars:\n        yaf_service: True\n      roles:\n         - role: cmusei.yaf\n           tags: ['yaf']\n\nLicense\n-------\n\nCopyright 2020 Carnegie Mellon University.\nNO WARRANTY. THIS CARNEGIE MELLON UNIVERSITY AND SOFTWARE ENGINEERING INSTITUTE MATERIAL IS FURNISHED ON AN \"AS-IS\" BASIS. CARNEGIE MELLON UNIVERSITY MAKES NO WARRANTIES OF ANY KIND, EITHER EXPRESSED OR IMPLIED, AS TO ANY MATTER INCLUDING, BUT NOT LIMITED TO, WARRANTY OF FITNESS FOR PURPOSE OR MERCHANTABILITY, EXCLUSIVITY, OR RESULTS OBTAINED FROM USE OF THE MATERIAL. CARNEGIE MELLON UNIVERSITY DOES NOT MAKE ANY WARRANTY OF ANY KIND WITH RESPECT TO FREEDOM FROM PATENT, TRADEMARK, OR COPYRIGHT INFRINGEMENT.\nReleased under a MIT (SEI)-style license, please see license.txt or contact permission@sei.cmu.edu for full terms.\n[DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimited distribution.  Please see Copyright notice for non-US Government use and distribution.\nCERT® is registered in the U.S. Patent and Trademark Office by Carnegie Mellon University.\nThis Software includes and/or makes use of the following Third-Party Software subject to its own license:\n1. ansible (https://github.com/ansible/ansible/tree/devel/licenses) Copyright 2019 Red Hat, Inc.\n2. molecule (https://github.com/ansible-community/molecule/blob/master/LICENSE) Copyright 2018 Red Hat, Inc.\n3. testinfra (https://github.com/philpep/testinfra/blob/master/LICENSE) Copyright 2020 Philippe Pepiot.\n\nDM20-0509\n\n\nAuthor Information\n------------------\n\nThis role was created in 2020 by [Matt Heckathorn](https://resources.sei.cmu.edu/library/author.cfm?authorID=2403).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcmu-sei%2Fansible-role-yaf","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcmu-sei%2Fansible-role-yaf","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcmu-sei%2Fansible-role-yaf/lists"}