Hi Gerhard, I suggest as first step to upgrade to a recent 0.14 release and compile it yourself. Since you speak of 70GB traffic, make sure when configuring the package for compilation the --enable-64bit switch is specified.
About 1) i can suggest to turn on some internal buffering (at this propo see the email i've just sent): http://www.mail-archive.com/[email protected]/msg01978.html About 2) i can't provide an answer. Trusting your awk is correct (which absolutely looks like it is) it might be a bug fixed in due course? Cheers, Paolo On Thu, Jun 14, 2012 at 11:27:46AM +0100, Gerhard Lazu wrote: > I have pmacct v0.11.6 running on Ubuntu 10.04 for about 8 hours now, using > the following config: > > daemonize: true > pidfile: /var/run/pmacctd.pid > syslog: daemon > ! > ! interested in in and outbound traffic > aggregate: src_host,dst_host,src_port > ! on this interface > interface: eth0 > > When I sum the counters for port 6201, I get: > > $ pmacct -c src_port -N 6201 -n bytes | awk '{ print $1 " Bytes"; print $1 > / 2^30 " Gigabytes" }' > 709264151 Bytes > 0.660554 Gigabytes > > When I do the summing in awk, I get: > > $ pmacct -s | awk '/ 6201 / { total+=$5 } END { print total " Bytes"; print > total / 2^30 " Gigabytes" }' > 13595724124 Bytes > 12.662 Gigabytes > > However, I know for a fact that the service running on port 6201 has > transferred at least 70 Gigabytes within this period, all TCP traffic. > > This leads me to 2 questions: > > 1. Why are the pmacct counters off by that much? > > 2. Why the huge difference between pmacct -c & pmacct -s with awk summing? > > Cheers, Gerhard > > ------------------------------ > Twitter <http://twitter.com/#!/gerhardlazu> Github<https://github.com/gerhard> > Blog <http://gerhardlazu.com/> > _______________________________________________ > pmacct-discussion mailing list > http://www.pmacct.net/#mailinglists _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
