Hi, >> We also know that Netflow v9 is customizable. i.e I can define my own >> set of statistics to be exported to the collector. Is there a way to >> define the customized set in the pmacct (nfacct), so that nfacctd >> identifies those packets accordingly and stores it in the sql database? >> Pre-tagging supports only a subset of these.
>Good point. I assume you mean you don't want to code in the customised >NetFlow v9 information (this would be easy given the modularity of this >part of the code) but rather you want to see in pmacct a way to define >customized information, via a configuration file, and then possibly >match them through the Pre-Tagging infrastructure. >If this is the case, unfortunately, while being a good idea this is >not currently possible; i thought several times about it, not only in >terms of Pre-Tagging primitives but also more importantly in terms of >aggregation primitives. This is definitely in the radar but i have no >immediate plans of implementing this, being busy on other juicy things >for the upcoming 0.12 trunk. But hey, contributions are warmly welcome! I was looking at the interface information in particular. I see that pre-tag supports that but the problem here is I have to know the interface numbers in advance to define rules in pre-tag config files. If my network is huge, assuming I know my interface index numbers, the config file will be huge if I have to identify each flow. So I was planning to add the interface (in and out) into aggregation rules so that it is listed in the sql database as part of the flow. Which c files do I need to look into if I want to provide this support? Thanks, Suraj.N > -----Original Message----- > From: pmacct-discussion-boun...@pmacct.net > [mailto:pmacct-discussion-boun...@pmacct.net] On Behalf Of Karl O. Pinc > Sent: Monday, June 08, 2009 6:35 PM > To: Paolo Lucente; pmacct-discussion@pmacct.net > Subject: Re: [pmacct-discussion] input/output interface informationin > nfacctd? > > > On 06/08/2009 06:00:46 PM, Paolo Lucente wrote: > > Hi Suraj, > > > > This information is not immediately available within the > > database or memory table; but you can match such fields > > within the Pre-Tagging infrastructure to generate a tag > > - which can, in turn, be either just used internally for > > filtering or splitting data among the plugins or can be > > made available to the backend via the 'tag' aggregation > > primitive. > > Good summary of what tagging is for. Is there a place > to drop it on the wiki? > > > > > See 'examples/pretag.map.example' in the pmacct tarball; > > also pre_tag_map and pre_tag_filter in the CONFIG-KEYS > > document. > > > > Cheers, > > Paolo > > > > > > On Mon, Jun 08, 2009 at 06:07:56PM -0400, Suraj Nellikar (snellika) > > wrote: > > > Hi, > > > > > > Doesn't the pmacct collector (I am running nfacctd) provide the > > Input > > > Interface,Output Interface information which is present in the > > Netflow > > > packets? > > > > > > > > > > > > Thanks, > > > > > > Suraj.N > > > > > > > _______________________________________________ > > pmacct-discussion mailing list > > http://www.pmacct.net/#mailinglists > > > > > > > Karl <k...@meme.com> > Free Software: "You don't pay back, you pay forward." > -- Robert A. Heinlein > > _______________________________________________ > pmacct-discussion mailing list > http://www.pmacct.net/#mailinglists _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
