Hello Sebastien, can you please check the date on the NetFlow agent side (don't know if you are actually using a router or a software probe) ? After figuring out that you are using nfacctd (i totally missed this point), unless you switch the 'nfacctd_time_new' directive to 'true', the 'stamp_inserted' field is calculated upon the timestamp inside the NetFlow entry; the 'stamp_updated' is still generated by pmacct, instead. Enabling the directive makes pmacct to ignore the timestamps enclosed into the NetFlow entries and to generate new ones basing on the time the NetFlow datagram is received (which should be not that influent in an accounting scenario). So, two tests: a) check the date on the NetFlow agent side and b) insert the following line in the configuration: 'nfacctd_time_new: true'.
Let me know how things get evolved. Cheers, Paolo
