CPM - match and collect keywords
When implementing Cisco Performance Monitor, one of the tasks is to create a flow record that matches particular traffic and collects specific metrics. This is achieved using the match and collect keywords. The following is an example of a flow record that contains several match and collect statements.
R1(config)#flow record type performance-monitor FLOW_RECORD_TCP R1(config-flow-record)#match ipv4 protocol R1(config-flow-record)#match ipv4 source address R1(config-flow-record)#match ipv4 source prefix R1(config-flow-record)#match ipv4 destination address R1(config-flow-record)#match ipv4 destination prefix R1(config-flow-record)#match transport source-port R1(config-flow-record)#match transport destination-port R1(config-flow-record)#collect routing forwarding-status R1(config-flow-record)#collect ipv4 dscp R1(config-flow-record)#collect ipv4 ttl R1(config-flow-record)#collect ipv4 source mask R1(config-flow-record)#collect ipv4 destination mask R1(config-flow-record)#collect transport round-trip-time R1(config-flow-record)#collect transport event packet-loss counter R1(config-flow-record)#collect interface input R1(config-flow-record)#collect interface output R1(config-flow-record)#collect counter bytes R1(config-flow-record)#collect counter packets R1(config-flow-record)#collect counter bytes rate R1(config-flow-record)#collect timestamp interval R1(config-flow-record)#collect application media bytes counter R1(config-flow-record)#collect application media packets rate R1(config-flow-record)#collect application media event R1(config-flow-record)#collect monitor event
The match keyword is used to define criteria for classifying network traffic. When configuring a flow record, the match statements specify the conditions that packets must meet to be considered part of the flow.
The collect keyword, on the other hand, is used for gathering statistics or metrics about the traffic that has been matched and classified into this flow. When you use the collect command, it enables the monitoring and recording of specific information about the traffic that has been matched using the match keyword.
There is another distinction between match and collect that is especially useful: Match criteria are considered key fields while collect parameters are considered nonkey fields.
So flows are defined using the match statement, and the information that is monitored about that flow is specified using the collect statement.
Links:
https://forum.networklessons.com/t/cisco-performance-monitor/5352/10?u=lagapidis
https://networklessons.com/cisco/ccie-routing-switching-written/cisco-performance-monitor