Hi Ed,
Yes, absolutely!
Paolo
On Mon, Feb 27, 2017 at 09:34:16AM -0600, Edward Henigin wrote:
> Thank you Paolo!
>
> But would it simply be safe to say that we are not missing any netflow data
> if I never see the log line?
>
> # fgrep syslog /etc/pmacct/nfacctd.conf
> syslog: daemon
> # fgre
Thank you Paolo!
But would it simply be safe to say that we are not missing any netflow data
if I never see the log line?
# fgrep syslog /etc/pmacct/nfacctd.conf
syslog: daemon
# fgrep -i expecting /var/log/daemon
#
That would be my working assumption.
Thanks,
Ed
On Sat, Feb 25, 2017 at 7:19
Hi Ed,
The log message produced is actually very simple:
Log([..] expecting flow '%u' but received '%u' collector=%s:%u agent=%s:%u
[..]);
It's a start for some basic analysis but you can get false positives,
for example due to out of order arrival of packets. In recent pmacct
releases you hav
Paolo, can you help with this one please?
On Thu, Feb 23, 2017 at 11:09 AM, Edward Henigin wrote:
> I see in the config keys for nfacctd that by default it checks sequence
> numbers and will log an error if any are missing.
>
> [ nfacctd_disable_checks | sfacctd_disable_checks ] [GLOBAL, NO_PMAC
I see in the config keys for nfacctd that by default it checks sequence
numbers and will log an error if any are missing.
[ nfacctd_disable_checks | sfacctd_disable_checks ] [GLOBAL, NO_PMACCTD]
Values
[true|false]
Desc
both nfacctd and sfacctd check health of incoming NetFlow/sFlow datagrams -
