Hi Nikolay,
Thanks for confirming you are all set for now and for sharing the
additional info, much appreciated!
Paolo
On 19/11/24 11:28, Nikolay Kichukov wrote:
Hello Paolo,
No problem for the delay, I see the list is not very active. I was able
to somehow get consistent ifIndexes in the flows for the interfaces in
question, see detailed discussion on the akvorado board here:
https://github.com/akvorado/akvorado/discussions/1442
and the already merged akvorado pull request that now has perhaps not so
good example, but a working example for pmacctd:
https://github.com/akvorado/akvorado/pull/1455/files
Once we have to revisit this topic again we may need to fine-tune this
setup a bit more, to avoid any potention duplication that may be
happening or just make it better suited to our needs.
But it works for the moment.
Thank you!
On Thu, 2024-11-14 at 02:00 +0100, Paolo Lucente wrote:
Hi Nikolay,
Apologies for the late reply: can you please share your integral
config
and the version you are running? For the latter a 'pmacctd -V' would
do.
Paolo
On 17/10/24 16:31, Nikolay Kichukov wrote:
Hi folks,
We have a setup where the pmacctd system does not run SNMP daemon so
on
the flow receiver we have static mappings, ie:
index 1:
name: lo
description: loopback
speed: 100000
and so on for the rest of the interfaces.
The issue is that on some of our pmacctd deployments, the interface
index differs(even though these are absolutely the same deployments,
we've not yet identified why this so is). Because they differ, not
all
flows get properly classified, and we get to see the fallback name
and/or description. Worst case is, interface mismatch, which then
gives
wrong data.
Is it possible to somehow combine the pcap_interfaces_map file with
the
pre_tag_map and send static interface indexes in the flows? Or use
another mechanism to achieve this?
Our pcap_interfaces_map currently contains the list of interfaces we
are
interested in, ie:
ifindex=1 ifname=lo
... and the rest of the interfaces, here we define the ifindex, the
way
we want it in the flows.
The pre_tag_map file conatains:
set_tag=1 filter='dst net 127.0.0.0/8' jeq=eval_ifindexes
set_tag=2 filter='src net 127.0.0.0/8' jeq=eval_ifindexes
set_tag=1 filter='dst net ::1/128' jeq=eval_ifindexes
set_tag=2 filter='src net ::1/128' jeq=eval_ifindexes
...
for the direction and
set_tag2=1 filter='dst host 127.0.0.1' label=eval_ifindexes
set_tag2=1 filter='src host 127.0.0.1'
set_tag2=1 filter='dst host ::1'
set_tag2=1 filter='src host ::1'
...
for the index.
So for the interface that got the unexpected index, the set_tag2
would
have some random number, which we wanted to be fixed and static.
Any way to bind the interfaces map index and set_tag2 index so we
end up
sending flows with fixed interface indexes for the specific
interfaces
in all our deployments?
Thank you!
_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists
_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists
