Hi Olaf, On Sat, Sep 17, 2011 at 11:05:02AM +1000, Olaf de Bree wrote:
> I have nfacctd up and running and it is receiving flows from my test > router. > > when doing a debug i can see #95 field arrive in the net flow template (see > debug below) > > [ ... ] > > What i really not sure of is how to filter or report on the #95 (Application > ID) field on incoming flows and also store in a DB Great, it all looks good so far. I suggest to modify the following aggregation method: aggregate: src_host, dst_host, src_port, dst_port, proto into: aggregate: sum_host, class To start with and verify whether it works. Then you will probably reckon some non-local IP addresses popping up in your accounting (ie. youtube server): my guess is you might not be interested into these and hence you might want to filter in only local networks. Two strategies to accomplish this (read docs for further information) are: aggregate_filter or networks_file. Let me know how it goes. Cheers, Paolo _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
