Hi all,
I am using pmacctd with libpcap. My configuration is the following: daemonize: falsepcap_filter: port 80 // only interested in HTTP trafficplugin_pipe_size: 102400000plugin_buffer_size: 102400aggregate: src_host,dst_host,src_port,dst_port,proto,classclassifiers: [path_to_classifier]snaplen: 500interface: anyplugins: printprint_num_protos: trueprint_cache_entries: 15485863print_output: csvprint_time_roundoff: mhdprint_output_file: file.%s.%Y%m%d-%H%M.txtprint_refresh_time: 300 I have defined one classifier and, on the machine I am using, CPU usage of the core process is close to 100%.I have read the relevant FAQ question about high CPU usage and applied what it proposes. The question now is how pmacct could cope with more traffic:- are there any other ways to optimize pmacct itself or its configuration?- I was thinking of launching multiple pmacctd instances, each instance receiving a portion of the traffic. This split could be done through BPF filter. How would you split the traffic? For example, you can split based on one bit of the IP address... The goal would be that the separate instances are balanced in terms of CPU usage.- Is pmacct compiled with all relevant gcc optimizations? Thanks,Stathis
_______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
