Hello,
I'm (once again) trying to export netflow from a Linux / bird router to an
external probe. But I can't get src_as / dst_as in my netflow export...
bgp session between pmacct and bird is OK :
bird> show route export pmacct count
871845 of 2695832 routes for 876157 networks
if I set a "bgp_table_dump_file" file, it is filled with the full-view
content (stuff like :
{"timestamp": "2021-05-04 14:40:00", "peer_ip_src": "127.0.0.1",
"peer_tcp_port": 60836, "event_type": "dump", "afi": 1, "safi": 1,
"ip_prefix": "1.22.148.0/24", "bgp_nexthop": "149.14.152.113", "as_path":
"174 6453 4755 45528 45528 45528 45528 45528", "comms": "174:21100
174:22008", "origin": 0, "local_pref": 100, "med": 2021}
note that pmacctd stops with the following warning when it has finished to
write this file :
INFO ( default/core/BGP ): *** Dumping BGP tables - START (PID: 9379) ***
INFO ( default/core/BGP ): *** Dumping BGP tables - END (PID: 9379, TABLES:
2 ET: 8) ***
WARN ( default/core ): connection lost to 'ip-nfprobe'; closing connection.
WARN ( default/core ): no more plugins active. Shutting down.
Here's my config :
# cat /etc/pmacct/pmacctd.netflow.conf
debug: false
daemonize: false
interface: bond0
aggregate: etype, tag, src_host, dst_host, src_port, dst_port, proto, tos,
src_as, dst_as, vlan
nfprobe_version: 10
plugins: nfprobe[ip]
nfprobe_receiver[ip]: 192.168.156.109:4739
nfprobe_timeouts[ip]: tcp=120:maxlife=3600
pmacctd_flow_lifetime: 30
sampling_rate: 10
pmacctd_as: bgp
bgp_daemon: true
bgp_daemon_ip: 127.0.0.1
!bgp_daemon_ip: ::
bgp_daemon_as: 203xxx
bgp_daemon_port: 17917
bgp_agent_map: /etc/pmacct/bgp_agent_map.map
bgp_peer_as_skip_subas: true
bgp_peer_src_as_type: bgp
! pre_tag_map: /etc/pmacct/pretag.map
! bgp_table_dump_file: /tmp/bgp-$peer_src_ip-%H%M.log
! bgp_table_dump_refresh_time: 600
# cat /etc/pmacct/bgp_agent_map.map
bgp_ip=185.x.y.z ip=0.0.0.0/0
Can somebody tell me what I'm missing ? I used to make it work about 1 year
ago... long time ago !
Thanks a lot for you help.
Regards
Cédric
_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists
