Have just started using pmacctd purely as an sflow probe on an embedded linux firewall. Looks promising, if I can iron out a few bugs.
sflow export works okay, however my collector (InMon) seems to be under-reporting data. As I'm collecting data successfully from 100s of switches without this issue, I'm guessing it's more pmacct related. After digging around a bit looking at the raw sflow packets, and the probe code, it looks to me like the interface counters aren't being collected/exported properly. Interface counters look more like they are counting the number of frames/octets for sampled frames, rather than total frames. Are these counters getting reset every packet that gets sampled? It would probably be better if the sfprobe plugin exported real interface information. That might also overcome the problem with ifIndex not matching between the sfprobe and an snmpwalk. Not very familiar with the pmacct code, so debugging this is proving to be tough. I'll keep looking though. Tim:> _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
