Hi all,
  I use following primary key in both sfacctd and nfacctd sql table.
-PRIMARY 
KEY(mac_src,mac_dst,ip_src,ip_dst,port_src,port_dst,ip_proto,timestamp_start,timestamp_start_residual
 )
  It works well on sfacctd’s sql table but failed on nfacctd with following 
error message:
-INSERT INTO nf_a4 (mac_src, mac_dst, vlan, cos, etype, ip_src, ip_dst, 
peer_ip_src, port_src, port_dst, tcp_flags, tos, ip_proto, country_ip_src, 
country_ip_dst, timestamp_start, timestamp_start_residual, timestamp_end, 
timestamp_end_residual, packets, bytes) VALUES ('00:00:00:00:00:00', 
'00:00:00:00:00:00', 0, 0, '800', '140.96.29.26', '10.201.23.80', 
'192.168.212.Sep 29 20:08:01 ERROR ( default/pgsql ): ERROR:  duplicate key 
value violates unique constraint "nf_a4_pkey"

  My analysis shows:

1.      The 2 netflow devices, 1 router and 1 firewall, output zero mac flows . 
 The mail-list said this might be due to the design of netflow agents.

2.      The timestamp_start_residual is zero.  In sfacctd’s case 
timestamp_start_residual isn’t zero.  This precious behavior makes 
timestamp_start+ timestamp_start_residual a unique time series.

3.      I don’t understand (1) and (2).  Are they bugs or behaviors?  If they 
are behaviors, what columns I should use to create primary key?

Any comment is appreciated.  Thanks in advance.

TC Wu
CCMA, ITRI, Taiwan


====================================================================
本信件可能包含工研院機密資訊,非指定之收件者,請勿使用或揭露本信件內容,並請銷毀此信件。 
This email may contain confidential information. Please do not use or disclose 
it in any way and delete it if you are not the intended recipient.
_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists

Reply via email to