Paolo et al.,
We are using pmacctd to collect throughput in and out of our IPs. The data is
aggregated into 5 minute periods. The first FULL 5 minute period is about
right: 5.6mb out, 400kb in. The rest of the periods are up to 100 times the
first. I've tried different configurations and included the relevant parts
of the latest here. (I left out the database name and username/password stuff.)
It pmacct-0.9.3 with --enable-mysql and --enable-64bit running on CentOS 3
distribution of Linux with 2.4.21-32.0.1.ELsmp kernel.
plugins: mysql[inbound], mysql[outbound]
aggregate[inbound]: tag,dst_host
aggregate[outbound]: tag,src_host
aggregate_filter[inbound]: dst net 209.97.32.0/20 and src net not 209.97.32.0/20
aggregate_filter[outbound]: src net 209.97.32.0/20 and dst net not 209.97.32.0/20
sql_table_version: 2
sql_refresh_time: 300
sql_optimize_clauses: true
sql_history: 5m
sql_history_roundoff: m
sql_dont_try_update: true
sampling_rate: 1
This table shows the data.
select agent_id, ip_src, ip_dst, stamp_inserted, stamp_updated, (bytes*8)/300
from acct_v2
where agent_id=1 and (ip_src='209.97.46.5' or ip_dst='209.97.46.5')
order by stamp_inserted, ip_src;
+----------+-------------+-------------+---------------------+---------------------+---------------+
| agent_id | ip_src | ip_dst | stamp_inserted | stamp_updated | (bytes*8)/300 |
+----------+-------------+-------------+---------------------+---------------------+---------------+
| 1 | | 209.97.46.5 | 2005-10-25 16:35:00 | 2005-10-25 16:40:01 | 281657.81 |
| 1 | 209.97.46.5 | | 2005-10-25 16:35:00 | 2005-10-25 16:40:01 | 3762442.16 |
| 1 | | 209.97.46.5 | 2005-10-25 16:40:00 | 2005-10-25 16:45:01 | 410088.11 |
| 1 | 209.97.46.5 | | 2005-10-25 16:40:00 | 2005-10-25 16:45:01 | 5594034.21 |
| 1 | | 209.97.46.5 | 2005-10-25 16:45:00 | 2005-10-25 16:50:01 | 449370128.85 |
| 1 | 209.97.46.5 | | 2005-10-25 16:45:00 | 2005-10-25 16:50:01 | 6185617705.95 |
| 1 | | 209.97.46.5 | 2005-10-25 16:50:00 | 2005-10-25 16:55:01 | 386387489.57 |
| 1 | 209.97.46.5 | | 2005-10-25 16:50:00 | 2005-10-25 16:55:01 | 1680149628.05 |
| 1 | | 209.97.46.5 | 2005-10-25 16:55:00 | 2005-10-25 17:00:01 | 352383882.27 |
| 1 | 209.97.46.5 | | 2005-10-25 16:55:00 | 2005-10-25 17:00:01 | 1672087210.40 |
| 1 | | 209.97.46.5 | 2005-10-25 17:00:00 | 2005-10-25 17:05:01 | 101990113.97 |
| 1 | 209.97.46.5 | | 2005-10-25 17:00:00 | 2005-10-25 17:05:01 | 1451469570.27 |
+----------+-------------+-------------+---------------------+---------------------+---------------+
I have made sure that my switch is giving me the rx and tx on only one port.
Any ideas what could be causing this?
Thanks,
Dave
