Hi Paolo, Thanks for getting back to me. The version of pmacct being used is 0.9.1-1ubuntu1. I'm not sure how the problem was discovered, but I have asked to person who found the problem to tell me and I will forward you the response. As for the reports, I'm not entirely sure what you need. I am considering going through the database data for each hour and comparing the total figures for uploaded and downloaded packets, per IP address between the two tables. Would this give you the information you're looking for?
-- Daniel Levy Aptivate | http://www.aptivate.org/ | +44 (0)1223 760887 The Humanitarian Centre, Fenner's, Gresham Road, Cambridge CB1 2ES Aptivate is a not-for-profit company registered in England and Wales with company number 04980791. Paolo Lucente wrote: > Hi Daniel, > > Unfortunately the configuration doesn't make evident where the > issue can be. The 'sql_dont_try_update' very well protects against > duplicate tuples - so i'm rather inclined to exclude that reason. > > Which version are you using? How you did discover the issue - ie. > did you upgrade recently from a previous version or is a fresh > installation? Finally, is it possible to get - privately - two > reports, one from each table, for the same time period? Say, one > or better two hours? > > Let me know. > > Cheers, > Paolo > > > On Fri, Feb 12, 2010 at 03:19:38PM +0000, Daniel Levy wrote: > >> Hi, >> >> I'm using pmacct to store data in two tables, one containing data >> recorded on a per minute basis, the other containing data recorded on an >> hourly basis. When I get data for the first table over a period of three >> hours, the download traffic (calculated by adding up the bytes field for >> traffic where the ip_dst value is from a machine on the local network) >> for one IP address on the network is 3,719,772,656 bytes. The download >> traffic from the second table for the same IP address over a period of >> one week, including the three hour period mentioned above, is >> significantly smaller (2,114,286,512 bytes) where I would expect it to >> be much larger and I can't figure out why. A slightly modified version >> of the contents of my pmacctd.conf file is given below. Can anyone help? >> >> daemonize: true >> pidfile: /var/run/pmacctd.pid >> syslog: daemon >> >> plugins: mysql[inbound1], mysql[outbound1], mysql[inbound2], >> mysql[outbound2] >> >> aggregate[inbound1]: src_host, src_port, dst_host, dst_port, proto >> aggregate[outbound1]: src_host, src_port, dst_host, dst_port, proto >> aggregate[inbound2]: src_host, src_port, dst_host, dst_port, proto >> aggregate[outbound2]: src_host, src_port, dst_host, dst_port, proto >> >> pcap_filter: not (src and dst net 0.0.0.0/24) >> >> >> sql_db: pmacct >> sql_table[inbound1]: short_data_table >> sql_table[outbound1]: short_data_table >> >> sql_table[inbound2]: long_data_table >> sql_table[outbound2]: long_data_table >> >> sql_history[inbound1]: 1m >> sql_history[outbound1]: 1m >> sql_history[inbound2]: 1h >> sql_history[outbound2]: 1h >> >> sql_history_roundoff[inbound1]: m >> sql_history_roundoff[outbound1]: m >> sql_history_roundoff[inbound2]: h >> sql_history_roundoff[outbound2]: h >> sql_table_version: 6 >> sql_host: localhost >> sql_user: auser >> sql_passwd: apass >> >> sql_refresh_time[inbound1]: 60 >> sql_refresh_time[outbound1]: 60 >> sql_refresh_time[inbound2]: 3600 >> sql_refresh_time[outbound2]: 3600 >> sql_dont_try_update: true >> sql_optimize_clauses: true >> >> sql_preprocess: minb = 1000 >> >> Regards >> >> -- >> Daniel Levy >> >> >> _______________________________________________ >> pmacct-discussion mailing list >> http://www.pmacct.net/#mailinglists >> > > _______________________________________________ > pmacct-discussion mailing list > http://www.pmacct.net/#mailinglists > _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
