Hi Peter, good point (again). pmacct actually lacks of such thing. But it could be good idea to implement it. The method will need some extra cares in order to make things work smoothly: a) writes need to be interleaved in order to avoid one plugin to lock out the other while racing for the same SQL table; b) with no tags, UPDATEs would become unavoidable. Here, the almost forgotten "post_tag" directive might be used to tag things coming from different plugins, thus avoiding "online" UPDATEs.
Rather than creating a whole new set of "reversed" primitives wouldn't it be better to create a new config directive ? In the end, the reverse concept would apply only to direction-specific primitives (ie. TCP/UDP ports and MAC/IP addresses) and one should not really want to reverse them singularly (as this would produce spurious tuples). Look at the following example: === ... aggregate[db_in]: tag,proto,src_host,dst_host,src_port,dst_port aggregate[db_out]: tag,proto,src_host,dst_host,src_port,dst_port aggregate_filter[db_in]: dst net 10.11.0.0/16 aggregate_filter[db_out]: src net 10.11.0.0/16 aggregate_reverse[db_out]: true plugins: pgsql[db_in], pgsql[db_out] sql_table[db_in]: acct sql_table[db_out]: acct post_tag[db_in]: 1 post_tag[db_out]: 2 ... === Thoughts ? I should be able to converge quickly on this ... Cheers, Paolo On Fri, May 19, 2006 at 12:09:41PM +0300, Peter Nixon wrote: > <snip> > This gives me 2 tables which is can then do an SQL JOIN (where > src_host=dst_host and dst_host=src_host and src_port=dst_port and > dst_port=src_port) to get complete data on each actual connection. What I > would like to be able to do is to reverse way the data is inserted in the > table for one of the 2 aggregate lines, and then put the data in the SAME sql > table. > > <snip> > > aggregate[db_in]: proto,src_host,dst_host,src_port,dst_port > aggregate[db_out]: > proto,src_host_reverse,dst_host_reverse,src_port_reverse,dst_port_reverse > aggregate_filter[db_in]: dst net 10.11.0.0/16 > aggregate_filter[db_out]: src net 10.11.0.0/16 > plugins: pgsql[db_in], pgsql[db_out] > sql_table[db_in]: acct > sql_table[db_out]: acct > > <snip> _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
