3 files changed, 77 insertions, 1 deletions
diff --git a/docs/system/eventhandler.rst b/docs/system/eventhandler.rst
new file mode 100644
index 00000000..6204abcc
--- /dev/null
+++ b/docs/system/eventhandler.rst
@@ -0,0 +1,48 @@
+.. _event-handler:
+
+Event Handler
+-------------
+
+Event handler allows you to execute scripts when a string that matches a regex appears in a text stream (e.g. log file).
+
+It uses "feeds" (output of commands, or a named pipes) and "policies" that define what to execute if a regex is matched.
+
+.. code-block:: sh
+
+  system
+  event-handler
+      feed <name>
+      description <feed description>
+      policy <policy name>
+      source
+          preset
+          syslog # Use the syslog logs for feed
+          custom
+          command <command to execute> # E.g. "tail -f /var/log/somelogfile"
+          named-pipe <path to a names pipe>
+      policy <policy name>
+      description <policy description>
+      event <event name>
+          description <event description>
+          pattern <regex>
+          run <command to run>
+
+In this small example a script runs every time a login failed and an interface goes down
+
+.. code-block:: sh
+
+  vyos@vyos# show system event-handler 
+  feed Syslog {
+      policy MyPolicy
+      source {
+          preset syslog
+      }
+  }
+  policy MyPolicy {
+      description "Test policy"
+      event BadThingsHappened {
+          pattern "authentication failure"
+          pattern "interface \.* index \d+ .* DOWN.*"
+          run /config/scripts/email-to-admin 
+      }
+  }
+\ No newline at end of file
diff --git a/docs/system/flowaccounting.rst b/docs/system/flowaccounting.rst
new file mode 100644
index 00000000..1231dcf3
--- /dev/null
+++ b/docs/system/flowaccounting.rst
@@ -0,0 +1,26 @@
+.. _flow-accounting:
+
+
+Flow Accounting
+---------------
+
+VyOS supports flow accounting through NetFlow or sFlow.
+
+For both types you need to specify the interfaces for which the data will be collected:
+
+.. code-block:: sh
+
+  set system flow-accounting interface eth0
+  set system flow-accounting interface bond3
+
+
+NetFlow is a protocol originating from Cisco Systems. It works on level3.
+VyOS supports version 1, 5 and 9
+
+NetFlow v5 example:
+
+.. code-block:: sh
+
+  set system flow-accounting netflow engine-id 100
+  set system flow-accounting netflow version 5
+  set system flow-accounting netflow server 192.168.2.10 port 2055
+\ No newline at end of file
diff --git a/docs/system/index.rst b/docs/system/index.rst
index aa414a82..368b62ff 100644
--- a/docs/system/index.rst
+++ b/docs/system/index.rst
@@ -10,7 +10,9 @@ should be ready for further configuration which is described in this chapter.
 .. toctree::
    :maxdepth: 2
    :hidden:
-
+   
+   eventhandler
+   flowaccounting
    host-information
    systemusers
    syslog