> OK. Traffic per IP per month you achieve it better with two plugins
> so to build tables proportional to your IP address space ('out' will
> count the active IP addresses in your network; 'in' will be way more
> rich due to scan activities):
>
> sfacctd.conf:
> ..
> plugins: mysql[out], mysql[in]
> aggregate[out]: src_host
> aggregate[in]: dst_host
> aggregate_filter[out]: src net <own IP chunk A> .. or src net <own IP chunk Z>
> aggregate_filter[in]: dst net <own IP chunk A> .. or dst net <own IP chunk Z>
> ..
>
> Perhaps you also want to distinguish between internal and external
> traffic? You can then do a bit of pre-tagging for that, so a tag of
> 1 means traffic is internal whereas a tag of 0 means it's external,
> ie.:
Currently I'm spliting the traffic by using the option:
networks_file: /etc/pmacct/sflow_networks.map
This way all internal traffic is marked with the correct
ip_dst and ip_src. And external traffic is marked with 0.0.0.0 for
the ip_dst or ip_src.
I could tag it.
Will give it a try and see how the db looks
--
Met vriendelijke groet,
Dennis Koster
"I take no responsibility if it formats your server, defrosts your fridge, or
touches your cat inappropriately."
_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists
