Jim Archer
Tue, 13 May 2008 13:49:07 -0700
Hi All... I'm wondering if there are any docs or samples for configuring the netflow and/or sflow plugins, beyond what accompanies the distribution of pmacct? I'm still having the issue below. It seems that the plugins combine the in and out data together, and the flow collector can not separate it. I must be configuring it wrong. Here is the conf I have been experimenting with: ! pmacctd configuration ! ! ! daemonize: false !debug: true interface: eth0 plugins: nfprobe[out], nfprobe[in] !plugins: print[in], print[out] !plugins: memory[in], memory[out] ! aggregate[in]: src_host, src_port, dst_host, dst_port, proto, flows, tos !aggregate_filter[in]: net 72.46.0.0/17 nfprobe_receiver[in]: 72.46.65.58:9996 nfprobe_version: 9 ! aggregate[out]: src_host, src_port, dst_host, dst_port, proto, flows, tos !aggregate_filter[out]: net 72.46.0.0/17 nfprobe_receiver[out]: 72.46.65.58:9996 nfprobe_version: 9 ! Any hints, please? --On Saturday, May 10, 2008 4:38 AM -0400 Jim Archer <[EMAIL PROTECTED]> wrote: > Hi All... > > I am trying to use pmacct on a Vyatta router to generate netflow, to be > collected by Netflow Analyzer by ManageEngine. The operating system is > Debian Lenny. > > I installed the pmacct package from Lenny and had no trouble setting it > up. I used the Debian method of setting the environment variable to > "eth0 eth1 eth2" because those are the interfaces I want to monitor. I > provided a conf file for each interface, names appropriately. > > Staring pmacct using the script in init.d results in 6 processes, > apparently two for each interface. Also, netstat shows three udp > sessions to the IP that the Netflow app resides on, on the correct port. > > But there is a problem. Netflow shows that there is data but only from > one interface. It shows data in only, none out. If I use a Cisco 7200 > to generate netflow, Netflow Analyzer shows all the interfaces in each > flow. > > I have checked a bunch of things, all with no luck. Does anyone have any > idea what I might have done wrong? > > Thanks very much... > > Jim > > > _______________________________________________ > pmacct-discussion mailing list > http://www.pmacct.net/#mailinglists _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists