Thanks for your help firstly I tried your suggestion, but still only light traffic could be captured I searched the forums and find out similar problem within this threat named Q. about aggregate_filter and nfacctd I remember I did the accuracy test before I create the aggregation filter, it was good. Any suggestions? Thanks!
2012/11/16 Brian Talley <[email protected]> > Have you tried with "nfacctd_renormalize: true"? > > http://wiki.pmacct.net/OfficialConfigKeys > > BT > > > On Thu, Nov 15, 2012 at 1:22 AM, Wei Wang <[email protected]> wrote: > >> Hi all, >> >> I am doing a system which is used to monitor the internet usage of >> customer for administrator. >> >> I use netflow to capture data, and nfacctd to analyse the netflow >> packages >> >> Everything is set up, and it works fine, but when I am doing the >> accuracy test, it seems that the amount of data which nfacctd stored in >> mysql does not match the amount of data I >> >> used. >> >> >> Here is my config file: >> >> daemonize: true >> >> debug: true >> >> nfacctd_time_new: true >> >> nfacctd_ip: X.X.X.X >> >> nfacctd_port: 9990 >> >> !logfile: /netflow/pmacct/logfile/file.log >> >> >> >> plugin_pipe_size: 20480000 >> >> plugin_buffer_size: 20480 >> >> >> >> aggregate[inbound]: dst_host >> >> !aggregate[outbound]: src_host >> >> >> >> aggregate_filter[inbound]: dst net X.X.69.0/24 >> >> !aggregate_filter[outbound]: src net X.X.69.0/24 >> >> >> >> plugins: mysql[inbound] >> >> >> >> sql_table[inbound]: acct_in_%Y_%m >> >> !sql_table[outbound]: acct_out_%M >> >> >> >> >> >> sql_host: localhost >> >> sql_user: XXXXX >> >> sql_passwd: XXXXX >> >> sql_db: pmacct >> >> sql_refresh_time: 300 >> >> sql_history: 1h >> >> sql_history_roundoff: m >> >> sql_table_schema[inbound]: /netflow/app.schema >> >> !sql_table_schema[outbound]: /netflow/app1.schema >> sql_optimize_clauses: true >> >> >> Here is the database rows >> >> ip_dst packs bytes time-inserted >> time-updated >> '', 'X.X.69.105', '', 32, 8662, '2012-11-15 18:30:00', >> '2012-11-15 18:40:02' >> '', 'X.X.69.105', '', 127, 36625, '2012-11-15 12:00:00', >> '2012-11-15 13:00:02' >> '', 'X.X.69.105', '', 122, 35258, '2012-11-15 13:00:00', >> '2012-11-15 14:00:01' >> '', 'X.X.69.105', '', 134, 38194, '2012-11-15 14:00:00', >> '2012-11-15 15:00:01' >> '', 'X.X.69.105', '', 122, 35134, '2012-11-15 15:00:00', >> '2012-11-15 16:00:02' >> '', 'X.X.69.105', '', 131, 38963, '2012-11-15 16:00:00', >> '2012-11-15 17:00:01' >> '', 'X.X.69.105', '', 85, 24814, '2012-11-15 17:00:00', >> '2012-11-15 17:45:02' >> '', 'X.X.69.105', '', 8, 2288, '2012-11-15 17:40:00', >> '2012-11-15 17:50:02' >> '', 'X.X.69.105', '', 104, 29849, '2012-11-15 17:50:00', >> '2012-11-15 18:00:03' >> '', 'X.X.69.105', '', 104, 24938, '2012-11-15 18:00:00', >> '2012-11-15 18:10:02' >> '', 'X.X.69.105', '', 348, 97539, '2012-11-15 18:10:00', >> '2012-11-15 18:20:03' >> '', 'X.X.69.105', '', 58, 14317, '2012-11-15 18:20:00', >> '2012-11-15 18:30:01' >> '', 'X.X.69.105', '', 32, 8662, '2012-11-15 18:30:00', >> '2012-11-15 18:40:02' >> >> Actually I was downloading a big file during this time. >> >> I cannot figure this out, and also network is pretty new for me. Any >> helps will be appreciate! >> >> >> >> >> _______________________________________________ >> pmacct-discussion mailing list >> http://www.pmacct.net/#mailinglists >> > > > > -- > Brian Talley > [email protected] > > > _______________________________________________ > pmacct-discussion mailing list > http://www.pmacct.net/#mailinglists >
_______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
