Before you can turn on the netflow sender (and built in netflow collector) you need to consider the impact this will have on your firewall. You should keep an eye on your CPU and ensure you aren't running above 50%, or you will probably have CPU contention issues. You also need to be aware that the memory usage of the netflow database and visualization will reduce your peek connections. This model is a NSA 3500 (http://www.sonicwall.com/us/products/NSA_3500.html) which previous to netflow could handle 35,000 stateful connections can only handle 49,152 when I have all of the DPI (Deep packet inspection) and Netflow enabled. This includes gateway antivirus, content filtering, IDS/IPS, and more. As you can see we don't go over 4000 which makes this a non-issue. Most firewalls can handle much higher workloads for connections and CPU than people are using.
First you have to turn on flow reporting. You can turn it on internally and or file it off to another netflow collector :
http://www.solarwinds.com/downloads/ - Solarwinds makes a nice free netflow collector as well.
When you click configure next to the "SonicWALL SSO Agent" then you get the following screen where you can setup the agent and view the stats to the agent process:
Email addresses and content can also be included in App Rules:
If you have any question please leave a comment or hit me up on twitter or instant messenger. I hope you found this useful!