Hi Oliver, you seem to be using sFlow. If that's the case, you might have to multiply the bytes counter by the sampling rate to get a pretty accurate view of the traffic. You can make pmacct to renormalize the counters for you by adding the following line to your config:
sfacctd_renormalize: true Hope this helps. Cheers, Paolo On Wed, Sep 19, 2007 at 11:09:31AM +0200, Oliver Treck (Treck.de - the WEB energyzer) wrote: > Hello. > > I'm new in this and have some problems with pmacct. > > I want to make an accounting for a hole subnet with large numbers of > IPs. The accounting should primary used for billing the use of traffic. > I set up pmacct with the following configuration: > > daemonize: true > pidfile: /var/run/sfacctd.pid > syslog: daemon > sfacctd_port: 6000 > sfacctd_ip: <LOKAL-IP> > aggregate: src_host,dst_host > networks_file: /etc/traffic/networks > plugins: mysql > plugin_pipe_size: 10240000 > plugin_buffer_size: 10240 > sql_host: localhost > sql_user: <MYSQL-USER> > sql_passwd: <MYSQL-PASS> > sql_db: pmacct > sql_table: acct_v7 > sql_table_version: 7 > sql_refresh_time: 5 > sql_optimize_clauses: true > sql_history: 1h > sql_history_roundoff: m > > This works in that way, that it fills the MySQL-Table with lots of data. > And internal traffic (network-ip to network-ip) is seperated from > traffic to the outside world. The only Problem i have is, that the > bytes-values are absolutely impossible. > > This for example are the entries for a hight traffic ip-address: > > <snip-snip> > > Here for "2007-09-13 12:00:00" it tells me the IP used "162458" bytes > and 159 Packets in that hour. That means it used just 159kb traffic??? > That is absolutly impossible for this ip and has to be much more. > Is it possible, that i have to multiply the bytes value with the > packets-value? Or are the bytes values already rounded to megabyte? > > I'm quite a bit confused about how to read this results and if they are > realy trustable. > > I would be glad, if someone could tell me how to understand this ad if > i'm doing something wrong. > > Best regards, > Oliver Treck _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
