Hi, Replies inline:
On Tue, Oct 16, 2012 at 08:24:52PM +0800, cyl123 wrote: > 1) I start pmacctd with plugins set to mysql. I send traffic stream to pmacct > using tcpreplay to replay a pcap tracefile. But there is no data generated in > database. I think I have set interface correctly, and I have tried to delete > the interface line in config file, in both way there is no data generated. Can you rule out the possibility NetFlow traffic is not hitting the application (pmacct)? A first step is to bind tcpdump on the collector box as follows: 'tcpdump -i eth2 -n port 2100'. Do you see packets coming in? If yes, next step is to verify packets are effectively being delivered to a listening application, you can use netcat for the purpose: 'nc -l -u -p 2100'. If this is also successful (you see 'dirt' being generated on the screen) then the issue is with pmacct or its configuration. > 2)Also, I have problem with plugins set to print. The config file is as > following: > > [ ... ] > > print_refresh_time: 900 > pirnt_output: csv > print_output_file: ... > print_time_roundoff: ... > > > After I run pmacctd, I get the following msg; > Unkown key: print_output. Line 8 ignored > Unkown key: print_output_file. Line 9 ignored > Unkown key: print_time_roundoff. Line 10 ignored What version of pmacct are you using? It could be it's too old for those switches. Please switch to >= 0.14.0. > 3) An another question: What kind of the data is the data stored in mysql > database? Is it decoded packet data or decoded netflow data? The reason to > ask this question is that we want to mine the data in database. You should clarify your question here: at a glance i would say it is (sampled) flow data as reported by NetFlow. Cheers, Paolo _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
