Thanks Paolo,
I'll give that a try.
On 07/28/2016 02:39 PM, Paolo Lucente wrote:
Hi Steve,
Try setting 'nfacctd_time_new: true' which would take as reference
time of arrival of the flow to the collector; you should get your
desired behaviour. Another solution is to keep nfacctd_time_new to
false and decrease to the minimum the active timeout on your NetFlow
exporter (what is happening now is that some long-lived flows is
being trapped at the exporter long time before being exported to
the collector).
Cheers,
Paolo
On Wed, Jul 27, 2016 at 11:30:47AM -0400, Stephen Clark wrote:
Hi List,
Maybe someone can point out what I am doing wrong. I am trying to
get nfacctd to only do inserts and not do updates
but my data looks like it is still doing updates, see row from pgsql below:
tag | ip_src | ip_dst | port_src | port_dst |
ip_proto | tos | packets | bytes | stamp_inserted |
stamp_updated | id | agent_id
-----+-----------------+-----------------+----------+----------+----------+-----+---------+-----------+---------------------+---------------------+---------+----------
0 | 172.24.110.112 | 19x.xx.xxx.xx | 60391 | 443 | 6
| 0 | 8 | 328 | 2016-07-27 10:55:00 | 2016-07-27
11:10:01 | 1313720 | 246
Notice stamp_inserted and stamp_updated - I would expect them to be
the same if the pgsql plugin was only doing inserts.
Here is my config.
daemonize: true
debug: false
pidfile: /var/run/nfacctd.pid
syslog: daemon
!logfile: /home/arodriguez/pmacct/pmacct-1.5.3/logfile
pre_tag_map: ./my.pretag.map
nfacctd_disable_checks: false
nfacctd_time_new: false
aggregate: tag, src_host, dst_host, src_port, dst_port, proto, tos
plugin_pipe_size: 4096000
plugin_buffer_size: 4096
plugins: pgsql
sql_table: acct_uni_custom
sql_data: typed
!sql_multi_values: 512000
sql_dont_try_update: true
sql_use_copy: true
sql_db: pmacct
sql_host: 127.0.0.1
sql_passwd: arealsmartpwd
sql_user: pmacct
sql_refresh_time: 300
sql_optimize_clauses: true
sql_history: 5m
sql_history_roundoff: m
sql_recovery_logfile: /var/lib/pmacct/recovery_log
!sql_table_version: 9
sql_preprocess: qnum=1000, minp=5
sql_locking_style: row
sql_cache_entries: 199999
imt_buckets: 65537
imt_mem_pools_size: 1024000
nfacctd_port: 2055
!nfacctd_ip: 127.0.0.1
!nfacctd_time_new: true
!nfacctd_allow_file: /etc/pmacct/allow
Any clarification would be appreciated.
Thanks,
Steve
_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists
--
"They that give up essential liberty to obtain temporary safety,
deserve neither liberty nor safety." (Ben Franklin)
"The course of history shows that as a government grows, liberty
decreases." (Thomas Jefferson)
_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists
