Hi, Have you tried looking in the original NetFlow packets, ie. with tcpdump or wireshark? I can't see pmacct mixing such information. Also, destination IP addresses are missing because you did not specify any aggregation method in your config, ie. try with:
aggregate: src_host, dst_host Cheers, Paolo On Fri, Nov 16, 2012 at 09:12:11PM +1100, Wei Wang wrote: > Hi all, > > I was trying to set up the nfacctd from beginning, but this time, I > have a big issue with the ip_dst field in mysql. > > The ip_dst is all 0s, but the ip_src has some ip address which > supposed to be in the ip_dst fields > > Fields marked by red are ip_dst > greens are ip_src > > > > '0:0:0:0:0:0', '0:0:0:0:0:0', 'XX.54.67.226', '0.0.0.0', 0, 0, 'ip', 76082, > 5755797, '2012-11-16 20:20:00', '2012-11-16 20:25:01' > > '0:0:0:0:0:0', '0:0:0:0:0:0', 'XX.54.67.5', '0.0.0.0', 0, 0, 'ip', > 4463, 2303225, '2012-11-16 20:20:00', '2012-11-16 20:25:01' > '0:0:0:0:0:0', '0:0:0:0:0:0', 'XX.54.67.38', '0.0.0.0', 0, 0, 'ip', 6986, > 9078272, '2012-11-16 20:20:00', '2012-11-16 20:25:01' > > > > > > Here is my config file: > > daemonize: true > > debug: true > > nfacctd_time_new: true > > nfacctd_ip: X.X.X.X > > nfacctd_port: 9990 > > logfile: /netflow/pmacct/logfile/file.log > > > > > sql_host: localhost > > sql_user: XXXXX > > sql_passwd: XXXXX > > sql_db: pmacct > > sql_refresh_time: 300 > > sql_history: 10m > > sql_history_roundoff: m > > > > Anyone suggestions? Thanks > _______________________________________________ > pmacct-discussion mailing list > http://www.pmacct.net/#mailinglists _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
