23.09.2009 09:59, Paolo Lucente пишет: > Hi Slava, > > On Tue, Sep 22, 2009 at 11:42:37PM +0300, Slava Dubrovskiy wrote: > > >> I wish to count only traffic from/to local IP. I.e. that in base were >> only my local IP. >> For this purpose I specify my local IP in networks_file and I aggregate >> by src_host, dst_host. >> >> I don't wish to store not local IP since then the base will be very big. >> >> Thus there are some networks (ua-list.txt) the traffic with which I need >> to count separately. >> So I make: >> >> aggregate[hourly]: src_host, dst_host >> aggregate[hourly_ua]: src_host, dst_host >> aggregate_filter[hourly_ua]: net 173.194.0.0/24 188.163.0.0/24 >> 193.0.227.0/24 >> plugins: mysql[hourly], mysql[hourly_ua] >> sql_table[hourly]: acct_base >> sql_table[hourly_ua]: acct_base_ua >> networks_file: /etc/pmacct/networks.list >> >> But how can I separate traffic from/to UA-IX? >> I can use aggregate_filter for this. And it work fine. >> >> But networks list is very big :( And I can't add full list to >> aggregate_filter. >> > OK: accounting for local IP addresses traffic and UA-IX networks > is two different things - no traffic matrix required. Hence, i > would propose you to change your config as follows: > > aggregate[hourly]: src_host, dst_host > aggregate[hourly_ua]: src_host, dst_host > plugins: mysql[hourly], mysql[hourly_ua] > sql_table[hourly]: acct_base > sql_table[hourly_ua]: acct_base_ua > networks_file[hourly]: /etc/pmacct/networks-local.list > networks_file[hourly_ua]: /etc/pmacct/networks-ua-ix.list > > The effect will be that the "hourly_ua" plugin will give you > a breakdown of the traffic at the UA-IX, plus you will find a > "catch all" entry every hour, ie. ip_src = 0, ip_dst = 0, > which is the hourly sum of all the traffic between your local > IP addresses and networks besides UA-IX. > Many thanks for the answer. But in that case to a database will get all IP that are specified in /etc/pmacct/networks-ua-ix.list. Namely it also is to be avoided. And then to me it is not necessary [hourly] since local IP enter UA-IX
But I think it the best variant that it is possible to make. > I did explain advantages of usin a networks_file rather than an > aggregate_filter in this scenario in a previous email (reloadable > at runtime and more efficient on long list of IP). Makes sense? > Yes, but to have the same mechanism for filtering it would be very good. -- WBR, Dubrovskiy Vyacheslav
smime.p7s
Description: S/MIME Cryptographic Signature
_______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
