HI Paolo,
I have configured Cisco Nexus to export L2 netfow.
Pmacct is matching and counting the bytes for IPv4 and IPv6 based on
ethertype.
====================================
plugins: memory
aggregate: src_mac,dst_mac,etype,vlan,flows
====================================
From Cacti, there is a script which read, extract and store the data in
the rrd file.
Extracted entries are deleted from memory using "-r" parameter.
====================================
/usr/local/bin/pmacct -c <aggr> -N <adata> -p <pipe> -r
====================================
<aggr> = etype
<adata> = 800 (for IPv4) and 86dd (for IPv6)
<pipe> = /tmp/collect.pipe
The snapshot of the graph that I've posted is just for IPv4.
I've tested this with Plixer's Scrutinizer and similar symptom is
observed. Perhaps the issue is with Nexus or the natural of netflow
accounting. If the "Closing ..." messages are normal behaviour, I
probably can rule out pmacct as the issue.
Thank you
/chunsing
Paolo Lucente <mailto:pa...@pmacct.net>
July 18, 2012 10:40 PM
Hi Chunsing,
On Tue, Jul 17, 2012 at 05:59:21PM +0800, Kerk Chun Sing wrote:
I'm exporting flows to pmacct (using memory plugin) and have Cacti plot the
data. There are regular gaps in the plotted graph.
Can you comment on the overall setup? How the memory table is
being queried by Cacti - down to the command-line being used?
> From the graph you attached i can't grasp whether that is some
time-aggregated view (ie. gaps might be missing measurements
in the original time-scale) or not (ie. no missing measurements
but sudden drops in traffic rates are detected).
Do anyone know what the "Closing..." messages mean? I felt that the gaps
might be related to this.
It's simply to say that the query received by a client was just
successfully processed. It's not reporting a problem in essence.
The "Selecting bucket" can be related to a search (ie. to serve
the client query) or an insert (ie. data coming from the network)
in the memory structure.
Cheers,
Paolo
_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists
--
/chunsing
_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists
