Hi Chris, Was wondering if it could be a counter-rollover issue. Did you configure pmacct to compile with the "--enable-64bit" knob?
Apart from the above - given you are aggregating on "src_host,dst_host" in pmacct, to save some precious space on your Sup720 NetFlow TCAM, i would recommend to use the "mls flow ip interface-destination-source" profile instead. Just curiosity: did you enable that "mls netflow interface" on purpose or it's there by itself? Cheers, Paolo On Sun, Oct 11, 2009 at 07:46:53PM +0200, Chris Hellkvist wrote: > Hi, > > i just set up pmacct and try to use nfacctd as netflow collector with > a mysql backend for accounting purposes. > The netflow v5 data is generated by a Cisco device with a sup720-3bxl > card and several GigE interfaces and sent to a FreeBSD box running > nfacctd. nfacctd is configured to store the data in a msysql datase on > a remote server. > After playing with some config options everything runs fine on the > first tests with only one vlan-interface generating netflow data (a > single customer with about 1000 mbits traffic on the vlan-interface). > nfacctd receives the data, summarizes it according to the networks > list and puts it into the mysql database every minute. The daily value > for this customer looks like this when selected every minute from the > database: > 2051 GB, 2058 GB, 2069 GB, 2074 GB, 2079 GB, 2085 GB, 2091 GB > This values are coherent for the traffic load on the interface. > > So i started configuring other interfaces to generate netflow data on > the Cisco device (about 1800mbits traffic). After this, the system > logs only about 1GB every minute for the same customer: > 2106 GB, 2107 GB, 2108 GB, 2109 GB, 2110 GB, 2112 GB, 2113 GB > > (I'd say that there is some lack of traffic ;-) ) > Now i'm trying to figure out where the data gets lost. The load on the > nfacct-box and the database servers is little (not more that 0.3 at > all time). I ran nfacctd in debug mode, but i did not find any > messages giving me a hint. > Also on the cisco box everything looks fine, no high cpu or memory load. > > For the records, a snippet of my nfacctd-config: > daemonize: true > #debug: true > networks_file: /root/conf/agtv-nets.list > aggregate: src_host,dst_host > nfacctd_port: 9787 > plugins: mysql > sql_optimize_clauses: true > sql_table_schema: /root/conf/dbs-dat.schema > sql_refresh_time: 60 > sql_history: 1d > sql_history_roundoff: d > sql_db: accounting > sql_table: tkue_%Y_%m_%d > sql_host: X > sql_passwd: Y > sql_user: Z > > Also the netflow-config on the cisco box: > ip flow-cache entries 520000 > ip flow-cache timeout active 1 > mls netflow interface > mls flow ip interface-full > mls nde sender version 5 > ip flow-export version 5 > ip flow-export destination 172.16.80.10 > > Maybe somebody on the list can give me a hint if there are any options > to optimize or if there is any bottleneck i did not think about - any > help is appreciated. > > Thanks, > Chris _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
