Hi Igor, I'm not aware of any issues with the 'sfacctd_renormalize' feature; perfect you already did some debug with sflowtool - that would have been my first suggestion.
I would ask you, if possible, to send me privately a brief capture of some sFlow datagrams (pcap format, full packets) so that i can have a look myself and replay them in a lab environment. This would also help understanding very quickly if the load of the system can be a viable explanation or not. Cheers, Paolo On Mon, Dec 21, 2009 at 09:19:34PM +0100, Igor Ybema wrote: > Hi, > We are using pmacct (sfacctd) for 2 years now. > We are using sflow agent on HP procurve 3500 switches with sampling rate of > 1024. > > Before we didn't use the renormalize function and no preprocessing. We just > used kbytes in stead of bytes in our applications which worked fine. > Since a month we started to use the sflow_renormalize function but since > then we see the bytes counted for our 'incoming' table multiplied by a > factor of 1.5 to 2 (not accurate). > The 'outgoing' table does not show this behaviour. > > To figure out where the problem is, I tried a couple of things: > - using sflowtool to debug the packets -> meanSkip = 1024 and counting MB's > myself (with a little help of bash) gives me the total bytes I have send to > the test host > - using another sflow agent (foundry XMR router) on other sflow server with > renormalize on also gives me the correct values > - turning of renormalize and using "sql_preprocess: usrf=1024" also gives me > the correct values > - using the newest 0.12.0rc4 does not help > > So,.. using same sflow server and agents, same data etc... only switching > from renormalize to preprocess works for me right now. What could be the > problem? > The sflow server (combined mysql server) is a busy server hitting high cpu > and io waits. Could this cause issue's? > > > regars, Igor Ybema _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
