David Maple wrote:
Hi all,
I have pmacctd running on a dedicated machine listening on a gigabit
Ethernet port. It is only collecting half of the data that the router
is passing to it. For example, at this time, the 5 minute average from
the router (confirmed with ifconfig) is 136,087,000 bits/sec and pmacctd
is reporting only 70,212,327 bits/sec.
All I'm trying to do is produce 5 minute usage reports by IP address
for both source and destination traffic. When I have
sql_dont_try_update disabled, it brings the CPU on the MySQL server to
99%, so I have it enabled until I can put in a stronger MySQL server. I
have done this with and without sql_optimize_clauses with no difference.
Has anyone else gotten this working with this volume of traffic? If
so, I would appreciate knowing what you did to get it working.
It's probably worthwhile to investigate whether the updates/inserts are
actually using the table indexes. Turn on debug in MySQL or pmacctd to
get the query that's being run, then run it with "EXPLAIN ANALYZE update
... " in the mysql command line tool.
On my PostgreSQL database I have multiple indexes to handle the updates
plus the queries for the usage reporting.
I found that aggregating by IP src/dst pairs created a crazy amount of
data. So we're running two aggregates/filters - one to look at inbound
traffic by dest IP, and another for outgoing traffic by source IP. Basic
theory is that I don't care about where the traffic is going to on the
Internet, just who's responsible for it.
Wim
