Hello Paolo, No problem for the delay, I see the list is not very active. I was able to somehow get consistent ifIndexes in the flows for the interfaces in question, see detailed discussion on the akvorado board here: https://github.com/akvorado/akvorado/discussions/1442
and the already merged akvorado pull request that now has perhaps not so good example, but a working example for pmacctd: https://github.com/akvorado/akvorado/pull/1455/files Once we have to revisit this topic again we may need to fine-tune this setup a bit more, to avoid any potention duplication that may be happening or just make it better suited to our needs. But it works for the moment. Thank you! On Thu, 2024-11-14 at 02:00 +0100, Paolo Lucente wrote: > > Hi Nikolay, > > Apologies for the late reply: can you please share your integral > config > and the version you are running? For the latter a 'pmacctd -V' would > do. > > Paolo > > > On 17/10/24 16:31, Nikolay Kichukov wrote: > > Hi folks, > > > > We have a setup where the pmacctd system does not run SNMP daemon so > > on > > the flow receiver we have static mappings, ie: > > > > index 1: > > name: lo > > description: loopback > > speed: 100000 > > > > and so on for the rest of the interfaces. > > > > The issue is that on some of our pmacctd deployments, the interface > > index differs(even though these are absolutely the same deployments, > > we've not yet identified why this so is). Because they differ, not > > all > > flows get properly classified, and we get to see the fallback name > > and/or description. Worst case is, interface mismatch, which then > > gives > > wrong data. > > > > Is it possible to somehow combine the pcap_interfaces_map file with > > the > > pre_tag_map and send static interface indexes in the flows? Or use > > another mechanism to achieve this? > > > > Our pcap_interfaces_map currently contains the list of interfaces we > > are > > interested in, ie: > > > > ifindex=1 ifname=lo > > ... and the rest of the interfaces, here we define the ifindex, the > > way > > we want it in the flows. > > > > The pre_tag_map file conatains: > > set_tag=1 filter='dst net 127.0.0.0/8' jeq=eval_ifindexes > > set_tag=2 filter='src net 127.0.0.0/8' jeq=eval_ifindexes > > set_tag=1 filter='dst net ::1/128' jeq=eval_ifindexes > > set_tag=2 filter='src net ::1/128' jeq=eval_ifindexes > > ... > > > > for the direction and > > set_tag2=1 filter='dst host 127.0.0.1' label=eval_ifindexes > > set_tag2=1 filter='src host 127.0.0.1' > > set_tag2=1 filter='dst host ::1' > > set_tag2=1 filter='src host ::1' > > ... > > > > for the index. > > > > So for the interface that got the unexpected index, the set_tag2 > > would > > have some random number, which we wanted to be fixed and static. > > > > Any way to bind the interfaces map index and set_tag2 index so we > > end up > > sending flows with fixed interface indexes for the specific > > interfaces > > in all our deployments? > > > > Thank you! > > > > _______________________________________________ > > pmacct-discussion mailing list > > http://www.pmacct.net/#mailinglists _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
