Hi Jose, Great that you were able to get it working!
All renormalize does is multiply. Your device is sending 1 packet sample for every 256 packets that pass through whatever interface(s) are being sampled, or a 1/256th view of total traffic. You could take your data and multiply it by 256 after you store the original sample and it will use up less storage, or the other option is to use renormalize pmacct setting and just store the pre-multiplied value. Cheers, -Brent From: pmacct-discussion [mailto:pmacct-discussion-boun...@pmacct.net] On Behalf Of Jose Joaquin Anton Herrerias Sent: Thursday, April 17, 2014 7:36 AM To: pmacct-discussion@pmacct.net Subject: Re: [pmacct-discussion] Sflow in dlink 3420-28tc Hi Brent, Thank you very much, the sfacctd_renormalize: true works. Now can add the dlink 3420-28tc to the devices that works in the website. I want to understand how it works sflow and what does renormalize variable so if renormalize are false the sflow take the values of the sample for the ratio selected but If you activate the renomalize variable,sflow read all data until the last sample? Is correct? Someone can explain me? Best Regards. José J. Antón Herrerías Responsable de soporte técnico De: pmacct-discussion [mailto:pmacct-discussion-boun...@pmacct.net] En nombre de Jose Joaquin Anton Herrerias Enviado el: jueves, 17 de abril de 2014 15:14 Para: pmacct-discussion@pmacct.net<mailto:pmacct-discussion@pmacct.net> Asunto: Re: [pmacct-discussion] Sflow in dlink 3420-28tc Hi Brent, Wow a big mistake in my config, im going to change. I will put my feedback so I try to help anothers. Best Regards. José J. Antón Herrerías Responsable de soporte técnico De: pmacct-discussion [mailto:pmacct-discussion-boun...@pmacct.net] En nombre de Brent Van Dussen Enviado el: jueves, 17 de abril de 2014 14:03 Para: pmacct-discussion@pmacct.net<mailto:pmacct-discussion@pmacct.net> Asunto: Re: [pmacct-discussion] Sflow in dlink 3420-28tc Hi Jose, I think what you're looking for is the "sfacctd_renormalize: true" option in your config. This will take the defined sample rate out of the sflow sample header and apply it to values obtained by sfacctd. Speaking of sfacctd, I believe the port and IP settings in your config should be sfacctd not nfacctd? Interesting that it's working if you're in fact running the sfacctd daemon and not nfacctd. -Brent From: pmacct-discussion [mailto:pmacct-discussion-boun...@pmacct.net] On Behalf Of Jose Joaquin Anton Herrerias Sent: Thursday, April 17, 2014 12:01 AM To: pmacct-discussion@pmacct.net<mailto:pmacct-discussion@pmacct.net> Subject: [pmacct-discussion] Sflow in dlink 3420-28tc Hello, Im using sfacctd to get the sflow of a dlink 3420-28tc and it seems to get the data ok but its something that i dont know how to work. A few days ago we are using pmacctd with a port mirroring and cacti for account the traffic and draw all traffic in graphs. That was working pretty well. Now we are trying to switch to sflow and Im using the same method to draw the graph but as I read with a ratio sampler of 1 the sflow send 1 packet of 256 packets so using the sflow to draw the traffic in the cacti is not working because there is a lot diference in the graphs. For example for 1 server that I put a limited download I have a 858k because I limit the download to 100K/s but with sflow draws 404 bits per seconds. How to make sflow to pass the real data or convert the data to real traffic? For all who need I paste my config file of the sfacctd: ! ! pmacct: In + Out ! debug: true daemonize: true syslog: kern nfacctd_port: 6343 nfacctd_ip: 10.1.188.150 imt_mem_pools_size: 180000 imt_mem_pools_number: 20 plugin_pipe_size: 20480000 plugin_buffer_size: 20480 snaplen: 700 networks_file: /etc/pmacct/networks2.def plugins: memory[net_in], memory[net_out], memory[host_in], memory[host_out] aggregate[net_in]: dst_net aggregate[net_out]: src_net aggregate[host_in]: dst_host aggregate[host_out]: src_host imt_path[net_in]: /tmp/net_in.pipe imt_path[net_out]: /tmp/net_out.pipe imt_path[host_in]: /tmp/host_in.pipe imt_path[host_out]: /tmp/host_out.pipe Thank you for the help. Best Regards. José J. Antón Herrerías jan...@abserver.es<mailto:jan...@abserver.es>
_______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
