Re: [pmacct-discussion] nfacctd monthly accounting problem
My techs have just been restarting the server at the beginnibg of each month. If memory serves me correctly, the nfacctd service dies. Terry -Original Message- From: pmacct-discussion On Behalf Of Paolo Lucente Sent: Thursday, September 5, 2019 7:16 AM To: pmacct-discussion@pmacct.net Subject: Re: [pmacct-discussion] nfacctd monthly accounting problem Hi Terry, Thanks for reporting this issue. Can you elaborate a bit more on the 'nfacctd does not start accounting for the new month'? It just stops accounting or it keeps accounting on the old month (ie. it seems like it does not flip the month)? Or some different behaviour? The more details you can share, the better. Thanks, Paolo On Wed, Sep 04, 2019 at 04:25:38PM +, Terry Duchcherer wrote: > We are using nfacct to do monthly data accounting for our customers, all > works fine except at the beginning of a new month nfacctd does not start > accounting for the new month. Restarting the service corrects the problem. > > nfacctd version 1.7.1-git > Ubuntu version 16.04 > > Here is our config: > > nfacctd_port: 2055 > plugins: mysql[inbound], mysql[outbound] > sql_db: dbname > sql_host: localhost > sql_user: dbuser > sql_passwd: dbpass > sql_table[inbound]: acct_in > sql_table[outbound]: acct_out > aggregate[inbound]: dst_host > aggregate[outbound]: src_host > aggregate_filter[inbound]: dst net (nnn.nnn.nnn.nnn/22 or > nnn.nnn.nnn.nnn /22 or nnn.nnn.nnn.nnn /21) > aggregate_filter[outbound]: src net (nnn.nnn.nnn.nnn /22 or > nnn.nnn.nnn.nnn /22 or nnn.nnn.nnn.nnn /21) > sql_refresh_time: 300 > sql_history: 1M > sql_history_roundoff: h > > What am I missing? > > Thanks in Advance; > Terry > NETAGO > > > > > > > > > > > > [ Read 16 lines ] > ^G Get Help^O Write Out ^W Where Is^K Cut Text^J Justify ^C > Cur Pos ^Y Prev Page > ^X Exit^R Read File ^\ Replace ^U Uncut Text ^T To Spell^_ > Go To Line ^V Next Page > ___ > pmacct-discussion mailing list > http://www.pmacct.net/#mailinglists ___ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists ___ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
[pmacct-discussion] nfacctd monthly accounting problem
We are using nfacct to do monthly data accounting for our customers, all works fine except at the beginning of a new month nfacctd does not start accounting for the new month. Restarting the service corrects the problem. nfacctd version 1.7.1-git Ubuntu version 16.04 Here is our config: nfacctd_port: 2055 plugins: mysql[inbound], mysql[outbound] sql_db: dbname sql_host: localhost sql_user: dbuser sql_passwd: dbpass sql_table[inbound]: acct_in sql_table[outbound]: acct_out aggregate[inbound]: dst_host aggregate[outbound]: src_host aggregate_filter[inbound]: dst net (nnn.nnn.nnn.nnn/22 or nnn.nnn.nnn.nnn /22 or nnn.nnn.nnn.nnn /21) aggregate_filter[outbound]: src net (nnn.nnn.nnn.nnn /22 or nnn.nnn.nnn.nnn /22 or nnn.nnn.nnn.nnn /21) sql_refresh_time: 300 sql_history: 1M sql_history_roundoff: h What am I missing? Thanks in Advance; Terry NETAGO [ Read 16 lines ] ^G Get Help^O Write Out ^W Where Is^K Cut Text^J Justify ^C Cur Pos ^Y Prev Page ^X Exit^R Read File ^\ Replace ^U Uncut Text ^T To Spell^_ Go To Line ^V Next Page ___ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
Re: [pmacct-discussion] sfacctd aggregate_filter problems
This seems to have solved the problem. I would have never looked for this as there are no vlans on the interfaces where sFlow is enabled. Thanks very much for the info; Terry -Original Message- From: pmacct-discussion On Behalf Of Paolo Lucente Sent: Sunday, October 14, 2018 2:47 AM To: pmacct-discussion@pmacct.net Subject: Re: [pmacct-discussion] sfacctd aggregate_filter problems Hi Terry, It is possible that your sFlow exporter captures vlan info (which your NetFlow exporter does not). In which case the filter should be modified to reflect that. See: https://github.com/pmacct/pmacct/blob/master/QUICKSTART#L2466-#L2497 And more specifically this: https://github.com/pmacct/pmacct/blob/master/QUICKSTART#L2487-#L2491 Paolo On Sat, Oct 13, 2018 at 08:44:33PM +, Terry Duchcherer wrote: > I have been banging my head against a wall all day on this problem. > > I have two identical configuration files, 1 for nfacctd and 1 for sfacctd. > Only difference is the port info they listen to. > > nfacctd works perfect with the configuration, sfacctd does not. > > Here is the config: > > nfacct_port: 2055 or sfacctd_port: 6343 (Depends on which service I > start) > plugins: mysql[inbound], mysql[outbound] > sqldb: pmacct > sql_host: localhost > sql_user: pmacct > sql_passwd: ** > sql_table[inbound]: acct_in > sql_table[outbound]: acct_out > aggregate[inbound]: dst_host > aggregate[outbound]: src_host > aggregate_filter[inbound]: dst net (nn.nn.nn.nn/22 or nn.nn.nn.nn/22 > or nn.nn.nn.nn/21) > aggregate_filter[outbound]: src net (nn.nn.nn.nn/22 or nn.nn.nn.nn/22 > or nn.nn.nn.nn/21) > sql_refresh_time: 60 > sql_history: 1M > sql_history_roundoff: h > > nfacctd works perfectly, one line for each host in both mysql tables. > > sfacctd nothing wrote to the mysql tables. > If I comment out the two aggregate_filter lines, lots of data wrote to the > mysql tables including the subnets I want to aggregate. > > What could the possible difference be between nfacctd and sfacctd? > > Thanks in Advance; > Terry > > > > > ___ > pmacct-discussion mailing list > http://www.pmacct.net/#mailinglists ___ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists ___ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
[pmacct-discussion] nfacctd did not create new db table
We have been running nfacctd for several months now, but last night it did not create new database files for December. Here is our config: daemonize: true pidfile: /var/run/nfacctd.pid plugins: mysql[inbound],mysql[outbound] sql_db: pmacct sql_host: ** sql_user: ** sql_passwd: aggregate[inbound]: dst_host aggregate[outbound]: src_host nfacctd_port: 9996 sql_refresh_time: 120 sql_history: 1M sql_history_roundoff: mhM sql_table_version: 1 sql_table[inbound]: nfacctdown_%m sql_table[outbound]: nfacctup_%m sql_table_schema[inbound]: /etc/nfacctdown.schema sql_table_schema[outbound]: /etc/nfacctup.schema networks_file: /etc/nfacctd.networks networks_file_filter: true Instead of creating the new database tables, nfacctdown_12 and nfacctup_12, it just created a new row for the new months data. IE: Nov Data: stamp_inserted 2014-11-01 00:00:00 stamp_updated 2014-11-30 22:16:07 Dec Data: stamp_inserted 2014-11-30 23:00:00 stamp_updated 2014-12-01 09:43:40 This has worked properly in the past, just not this month. How can I get this to start using the correct table? How can I prevent this in the future? Terry ___ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
Re: [pmacct-discussion] nfacctd did not create new db table
I am curious if the time change in November didn't cause us a problem. The server did not have ntp time synchronization on it, and the router sending netflow data did. This has now been corrected so this server syncs with the router. Restarting the nfacctd service did create the new tables so all is good now, will watch this at the end of this month. From: pmacct-discussion [mailto:pmacct-discussion-boun...@pmacct.net] On Behalf Of Brent Van Dussen Sent: December-01-14 1:32 PM To: pmacct-discussion@pmacct.net Subject: Re: [pmacct-discussion] nfacctd did not create new db table Hi Terry, Did time change by an hour for you recently and does your server follow? It looks like your stamp_inserted shows up for 11-30 so that's definitely why it's going into the November table instead of December. Recommendation would be to lock server to GMT so it doesn't try to offset time, guessing pmacct isn't taking notice internally. Cheers, -Brent From: pmacct-discussion [mailto:pmacct-discussion-boun...@pmacct.net] On Behalf Of Terry Duchcherer Sent: Monday, December 1, 2014 9:24 AM To: pmacct-discussion@pmacct.netmailto:pmacct-discussion@pmacct.net Subject: [pmacct-discussion] nfacctd did not create new db table We have been running nfacctd for several months now, but last night it did not create new database files for December. Here is our config: daemonize: true pidfile: /var/run/nfacctd.pid plugins: mysql[inbound],mysql[outbound] sql_db: pmacct sql_host: ** sql_user: ** sql_passwd: aggregate[inbound]: dst_host aggregate[outbound]: src_host nfacctd_port: 9996 sql_refresh_time: 120 sql_history: 1M sql_history_roundoff: mhM sql_table_version: 1 sql_table[inbound]: nfacctdown_%m sql_table[outbound]: nfacctup_%m sql_table_schema[inbound]: /etc/nfacctdown.schema sql_table_schema[outbound]: /etc/nfacctup.schema networks_file: /etc/nfacctd.networks networks_file_filter: true Instead of creating the new database tables, nfacctdown_12 and nfacctup_12, it just created a new row for the new months data. IE: Nov Data: stamp_inserted 2014-11-01 00:00:00 stamp_updated 2014-11-30 22:16:07 Dec Data: stamp_inserted 2014-11-30 23:00:00 stamp_updated 2014-12-01 09:43:40 This has worked properly in the past, just not this month. How can I get this to start using the correct table? How can I prevent this in the future? Terry ___ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
[pmacct-discussion] nfacctd Networks Problem
Just trying to setup nfacctd to aggregate our traffic on a per host basis. To import into our billing application. Nfacct.conf debug: true ! daemonize: false nfacctd_time_new: true plugins: mysql aggregate: sum_host sql_db: pmacct sql_table: acct sql_table_version: 1 sql_passwd: ** sql_user: ** sql_host: 10.0.8.36 sql_refresh_time: 90 ! sql_optimize_clauses: true sql_history: 10m sql_history_roundoff: mh nfacctd_ip: 10.0.8.40 nfacctd_port: 9996 !logfile: /var/log/nfacctd.log ! sql_preprocess: qnum=1000, minp=5 networks_file: /etc/nfacctd.networks ! ports_file: ./ports.example /etc/nfacctd.networks 192.168.88.0/21 (Not Real Networks) 192.168.40.0/22 Debug Output: [root@pmacct sbin]# nfacctd -f /etc/nfacctd.conf INFO ( default/mysql ): 110592 bytes are available to address shared memory segment; buffer size is 168 bytes. INFO ( default/mysql ): Trying to allocate a shared memory segment of 4644864 bytes. DEBUG ( /etc/nfacctd.networks ): [networks table IPv4] nh: asn: 0 net: 192.168.40.0 mask: 22 DEBUG ( /etc/nfacctd.networks ): [networks table IPv4] nh: asn: 0 net: 192.168.88.0 mask: 21 DEBUG ( /etc/nfacctd.networks ): IPv4 Networks Cache successfully created: 1 entries. DEBUG ( /etc/nfacctd.networks ): [networks table IPv4] nh: asn: 0 net: 192.168.40.0 mask: 22 DEBUG ( /etc/nfacctd.networks ): [networks table IPv4] nh: asn: 0 net: 192.168.88.0 mask: 21 DEBUG ( /etc/nfacctd.networks ): IPv4 Networks Cache successfully created: 1 entries. INFO ( default/core ): waiting for NetFlow data on 10.0.8.40:9996 ( default/mysql ) *** Purging queries queue *** ( default/mysql ) *** Purging cache - START *** ( default/mysql ) *** Purging cache - END (QN: 0, ET: 0) *** OK: Exiting ... However, when this writes to MySQL it includes all hosts from all networks. The documentation seems straight forward, but it is not working for me. I have also tried limiting to a single /24 network, but still get all hosts. What am I doing wrong? Thanks in Advance; Terry ___ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
Re: [pmacct-discussion] nfacctd Networks Problem
Thank you, that was my problem. Terry -Original Message- From: pmacct-discussion [mailto:pmacct-discussion-boun...@pmacct.net] On Behalf Of Paolo Lucente Sent: Wednesday, December 04, 2013 5:53 PM To: pmacct-discussion@pmacct.net Subject: Re: [pmacct-discussion] nfacctd Networks Problem Hi Terry, What version of pmacct are you running? If a recent one, ie. = 0.14.3, you should have 'networks_file_filter: true' in your config in order to explicitely enable filtering (as is documented in the CONFIG-KEYS file). Cheers, Paolo On Thu, Dec 05, 2013 at 12:37:58AM +, Terry Duchcherer wrote: Just trying to setup nfacctd to aggregate our traffic on a per host basis. To import into our billing application. Nfacct.conf debug: true ! daemonize: false nfacctd_time_new: true plugins: mysql aggregate: sum_host sql_db: pmacct sql_table: acct sql_table_version: 1 sql_passwd: ** sql_user: ** sql_host: 10.0.8.36 sql_refresh_time: 90 ! sql_optimize_clauses: true sql_history: 10m sql_history_roundoff: mh nfacctd_ip: 10.0.8.40 nfacctd_port: 9996 !logfile: /var/log/nfacctd.log ! sql_preprocess: qnum=1000, minp=5 networks_file: /etc/nfacctd.networks ! ports_file: ./ports.example /etc/nfacctd.networks 192.168.88.0/21 (Not Real Networks) 192.168.40.0/22 Debug Output: [root@pmacct sbin]# nfacctd -f /etc/nfacctd.conf INFO ( default/mysql ): 110592 bytes are available to address shared memory segment; buffer size is 168 bytes. INFO ( default/mysql ): Trying to allocate a shared memory segment of 4644864 bytes. DEBUG ( /etc/nfacctd.networks ): [networks table IPv4] nh: asn: 0 net: 192.168.40.0 mask: 22 DEBUG ( /etc/nfacctd.networks ): [networks table IPv4] nh: asn: 0 net: 192.168.88.0 mask: 21 DEBUG ( /etc/nfacctd.networks ): IPv4 Networks Cache successfully created: 1 entries. DEBUG ( /etc/nfacctd.networks ): [networks table IPv4] nh: asn: 0 net: 192.168.40.0 mask: 22 DEBUG ( /etc/nfacctd.networks ): [networks table IPv4] nh: asn: 0 net: 192.168.88.0 mask: 21 DEBUG ( /etc/nfacctd.networks ): IPv4 Networks Cache successfully created: 1 entries. INFO ( default/core ): waiting for NetFlow data on 10.0.8.40:9996 ( default/mysql ) *** Purging queries queue *** ( default/mysql ) *** Purging cache - START *** ( default/mysql ) *** Purging cache - END (QN: 0, ET: 0) *** OK: Exiting ... However, when this writes to MySQL it includes all hosts from all networks. The documentation seems straight forward, but it is not working for me. I have also tried limiting to a single /24 network, but still get all hosts. What am I doing wrong? Thanks in Advance; Terry ___ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists ___ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists ___ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
