Hi Ross, On Fri, Mar 26, 2010 at 02:46:51PM -0400, Ross Vandegrift wrote:
> I'm curious if I can acheive better performance for generating sflow > data. My plan was to use the iptables statistics module to do the > sampling, to ensure that only sampled packets were being sent to > userspace. Since my sampling target is around 1:2000, this has the > potential to cut down on a lot of work sending packets to userspace > that will be ignored. > > Neil at InMon suggested this as a possible tactic for more efficient > sflow generation than sfacctd when looking at around 3Gb/s and > 500kpps. pmacctd appears to be keeping up, but around 55-80% CPU. > Traffic will continue to grow, and I'd like to see if I can't get > performance better to make the system last longer. I see. It's just not clear whether you are using pmacctd compiled against vanilla libpcap. If this is the case, i can advice to give a try to PF_RING. The kernel module can be configured for sampling by passing the "sample_rate" parameter. At a glance, it would just seem fitting better your scenario. In case you want to go this way, please use the code from the CVS as the build sub-system (configure script, etc.) has been patched to recognize presence of PF_RING. This will indeed make it in the upcoming release 0.12.1. Cheers, Paolo _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
