{{indexmenu_n>7}}
====== Searching Subscriber Statistics by IP Address ======
<note tip>
To enable this functionality, the following **components** are required:
  - [[en:dpi:dpi_components:qoestor|QoE Stor Module]]
  - [[en:dpi:dpi_components:dpiui|SSG DPI Management Interface]]
The following **licenses** are required:
  - SSG: [[en:dpi:opt_cgnat|CG-NAT — Network Address Translation and IPFIX Format Statistics Export]]
  - QoE: [[en:dpi:licensing#qoe_licensing|NAT Flow Statistics Collection, Compression, and Custom Filters.]]
</note>

The data set to be stored depends on the type of subscriber:
  * For a public IP address, exporting Full NetFlow to QoE Stor is sufficient. [[en:dpi:dpi_options:opt_statistics:statistics_ipfix|]]
  * For a private IP address, additional NAT Flow data collection — translation information — is required. [[en:dpi:dpi_components:qoestor:configuration:nat_flow]]

=====Data Types=====
  * **Raw (unaggregated) logs** are the full set of IPFIX fields and contain all the details: time, IP addresses, ports, and more. These logs provide information down to the second.
  * **Aggregated logs** are summarized data that is used for reports, such as subscriber or host TOPs. Aggregation groups events by time (for example, every 15 minutes) and removes unnecessary details such as ports. The result is data to analyze over time intervals, without exact timing.
Raw logs are needed for accurate analysis, while aggregated logs are needed for reporting.
\\ \\ 

In this case, information retrieval is performed on aggregated data. Initially, SSG exports raw data to QoE Stor, and by default, aggregation is performed every 15 minutes. 
[[en:dpi:dpi_components:dpiui:user_guide:admin_section:qoestor_man:fullflow_agg_change_step|More on changing aggregation and re-aggregation intervals]].

Raw unaggregated data is available in the following sections of QoE Analytics in the GUI:
  - //Raw Full NetFlow// (by default, data is stored for **2 hours**)
  - //Raw NAT Flow// (by default, data is stored for **2 hours**, QoE license required)
{{:en:dpi:qoe:use_cases:ip_statistics:unaggregated.png?nolink&300|}}

Aggregated statistics are available in the following sections of QoE Analytics in the GUI:
  - //NetFlow// (by default, data is stored for **14 days**)
  - //NAT Flow// (by default, data is stored for **14 days**), QoE license required)
{{:en:dpi:qoe:use_cases:ip_statistics:aggregated.png?nolink&300|}}

===== Configuring Data Retention Period =====
In the GUI, go to Administrator → GUI Configuration → Settings → QoE Stor: DB lifetime settings:
  * For Raw Full NetFlow, select //QoE Stor fullflow main log lifetime in hours// **(1)**. 
  * For NAT Flow, select //QoE Stor NAT aggregated log lifetime in days// **(2)**.

{{ :en:dpi:qoe:use_cases:ip_statistics:storage_setting.png?nolink&1200 |}}

When increasing the data retention period, it's recommended to enable the deletion of old data when the disk fills up: 
Administrator → GUI Configuration → Settings → QoE Stor: Disk settings → Select //Enable force moving data for DEFAULT disk// – choose //Enable data removing!// → Select //Move factor for DEFAULT disk// – set the value to //0.1//.

{{ :en:dpi:qoe:use_cases:ip_statistics:data_deletion.png?nolink&1200 |}}

You can find out how much disk space logs are using in QoE Analytics → Administrator → Reports → Tablespace info.

{{ :en:dpi:qoe:use_cases:ip_statistics:info.png?nolink&1200 |}}

===== Searching for Subscriber Activity in the SSG GUI =====

==== For a Private IP Address. NAT Flow Section. QoE License Required ====
<note tip>You can request a license from the GUI by filling out a form in the respective section or contact sd@vas.expert</note>

The ability to view subscriber activity data appears after generating the NAT log — instructions [[en:dpi:dpi_components:qoestor:configuration:nat_flow]].\\
In the GUI, navigate to QoE Analytics → NAT Flow.\\ 
In the NAT Flow section, you need to:
  - Select the time period
  - Enable the “Source IPv4-address” and “Destination IPv4-Address” filters (check the box)
  - Enter values for the enabled filters and apply changes

{{ :en:dpi:qoe:use_cases:ip_statistics:nat_flow_src_dest.png?nolink&1200 |}}

==== For a Public IP Address from Aggregated Data. NetFlow Section ====
In the GUI, navigate to QoE Analytics → NetFlow.\\ 
In the NetFlow section, you need to:
  - Select the time period **(by default stored for only 14 days!)**
  - Enable the “Subscriber,” “Login,” and “Host IP” filters (check the box)
  - Enter values for the enabled filters and apply changes
{{ :en:dpi:qoe:use_cases:ip_statistics:aggregated_netflow.png?nolink&1200 |}}

==== For a Public IP Address. Raw Full NetFlow Section ====
In the GUI, navigate to QoE Analytics → Raw Full NetFlow.\\ 
In the Raw Full NetFlow section, you need to:
  - Select the time period **(by default stored for only 2 hours!)**
  - Enable the “Source IPv4-address” and “Destination IPv4-Address” filters (check the box)
  - Enter values for the enabled filters and apply changes

{{ :en:dpi:qoe:use_cases:ip_statistics:fullflow.png?nolink&1200 |}}