GoFlow2 on Ubuntu 24.04 LTS

GoFlow2 is an open source network flow collector written in Go. Routers, switches, firewalls and hypervisors can export a summary of every conversation crossing them, but they each speak a different dialect: NetFlow v5, NetFlow v9, IPFIX or sFlow v5. GoFlow2 listens for all of them at once, decodes the templates and samples, and emits every record in one common schema, so everything downstream sees the same fields no matter which vendor sent it. This cloudimg image runs GoFlow2 2.2.6 from the official release binary on Ubuntu 24.04 LTS as a hardened systemd service.

Decoded records come out as newline delimited JSON, written to a file for a log shipper such as Promtail, Fluent Bit, Vector or Filebeat to collect, or published straight onto a Kafka topic in protocol buffer form for a streaming pipeline. GoFlow2 is deliberately the ingest stage and nothing more, which is what lets it stay fast enough to sit in front of a busy network; storage, aggregation, enrichment and graphing are left to the tools you already run. Every runtime option lives in one environment file, so changing listen ports, adding parallel sockets, switching to protobuf or moving to Kafka is a text edit and a service restart.

The image supplies the operational layer GoFlow2 does not ship itself. It has no web interface and no authentication of any kind, so its HTTP server is bound to loopback and an nginx reverse proxy publishes the Prometheus metrics behind HTTP Basic Auth whose password is generated uniquely on every first boot and never baked into the image, with a separate unauthenticated health path for load balancer probes. Decoded flows are written to a dedicated data disk rather than the root disk, because flow volume filling a root filesystem is the classic way a collector fails, and rotation keeps fourteen compressed generations using a signal based reopen so no record is lost or duplicated. Kernel receive buffers are tuned for bursty exporter traffic, the collector runs as a dedicated unprivileged system user, and a synthetic flow generator is included so you can prove the collector is decoding before you point production exporters at it.

GoFlow2 is distributed under the BSD 3-Clause License, free and open source with no per CPU or per deployment fee. cloudimg is not affiliated with or endorsed by the GoFlow2 project; GoFlow2 is a mark of its owner. cloudimg provides packaging, the secure by default configuration, per instance credential automation, security patching, and 24/7 support with a guaranteed 24 hour response SLA.