Hi,
I have a question - maybe somebody had a similar issue - I'm receiving
netflow from router (Juniper) - they are sampled 1:2000
After the traffic is recalculated by nfacctd - in comparision to statistics
received via snmp - I have strange values - in the lowest traffic level
snmp shows around 550Mbps - in the same time traffic calculated by nfacctd
is ~1.3Gbps - in max point - snmp is showing 6Gbps but nfacctd 3.9 Gbps
I understand that traffic is sampled so it won't be exactly at the same
level as counted by snmp - but isn't it too big difference ?
Instead of this - the characteristics of the traffic is correct - traffic
is growing in the same direction, traffic drops are present in the same
time etc. - only this traffic level..
This is conifguration from router - it's quite simple:
sampling {
input {
rate 2000;
max-packets-per-second 7000;
}
family inet {
output {
flow-server x.x.x.x {
port x;
autonomous-system-type origin;
no-local-dump;
source-address x.x.x.x;
version 5;
}
}
}
}
in nfacctd config file - I recalculate netflows like this:
sql_optimize_clauses: true
sql_dont_try_update: true
sql_multi_values: 1024000
sql_db: pmacct
sql_host: <host>
sql_passwd: <pass>
sql_table_version: 7
sql_table_type: bgp
sql_cache_entries: 256000
sql_preprocess: usrf=2000
>From this what I checked - the problem - for sure - is not in nfacctd,
netflow data received and recalculated by nfdump was almost the same -
maybe there is something different what I should change/modify to get
the traffic level little more accurate.
Thanks for response
Regards
Adam
_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists
