Hi, I'm running pmacct-0.14.1 and attempting to setup a bgp feed. The netflow feed is being tee'd from another process on the box so all the netflow packets have a source IP address of 127.0.0.2. The bgp feed is coming in from one of our routers. Here is a snippet from nfacctd.conf:
daemonize: true pidfile: /var/run/nfacctd.pid syslog: daemon ! debug: true ! aggregate[ucar_in]: src_as aggregate_filter[ucar_in]: dst net 128.117.0.0/16 aggregate[ucar_out]: dst_as aggregate_filter[ucar_out]: src net 128.117.0.0/16 ! plugin_buffer_size: 1024 nfacctd_port: 9992 ! nfacctd_time_secs: true nfacctd_time_new: true plugins: memory[ucar_in], memory[ucar_out] imt_path[ucar_out]: /tmp/pmacct_out.pipe imt_path[ucar_in]: /tmp/pmacct_in.pipe networks_file: /etc/pmacct/networks.def bgp_daemon: true !bgp_daemon_msglog: true bgp_daemon_ip: 192.XXX.XXX.XXX bgp_daemon_max_peers: 100 nfacctd_as_new: bgp bgp_peer_src_as_type: bgp bgp_src_as_path_type: bgp bgp_src_local_pref_type: bgp bgp_src_med_type: bgp bgp_agent_map: /etc/pmacct/agent.map My agent.map looks like this: id=<ip of bgp source> ip=127.0.0.2 When bgp_agent_map config key is used, nfacctd attempts to start but then dies. Here are the log messages: =================================================================================================== Feb 22 12:07:02 testflow nfacctd[1437]: INFO ( default/core ): Start logging ... Feb 22 12:07:02 testflow nfacctd[1437]: INFO ( default/core ): Trying to (re)load map: /etc/pmacct/agent.map Feb 22 12:07:02 testflow nfacctd[1437]: INFO ( default/core ): map '/etc/pmacct/agent.map' successfully (re)loaded. Feb 22 12:07:02 testflow nfacctd[1437]: DEBUG ( default/core/BGP ): 1 thread(s) initialized Feb 22 12:07:02 testflow nfacctd[1437]: INFO ( default/core/BGP ): maximum BGP peers allowed: 100 Feb 22 12:07:02 testflow nfacctd[1437]: INFO ( default/core/BGP ): waiting for BGP data on 1xx.xxx.xxx.xxx:179 Feb 22 12:07:07 testflow nfacctd[1437]: INFO ( ucar_in/memory ): 131070 bytes are available to address shared memory segment; buffer size is 216 bytes. Feb 22 12:07:07 testflow nfacctd[1437]: INFO ( ucar_in/memory ): Trying to allocate a shared memory segment of 3538728 bytes. Feb 22 12:07:07 testflow nfacctd[1437]: INFO ( ucar_out/memory ): 131070 bytes are available to address shared memory segment; buffer size is 216 bytes. Feb 22 12:07:07 testflow nfacctd[1437]: INFO ( ucar_out/memory ): Trying to allocate a shared memory segment of 3538728 bytes. Feb 22 12:07:07 testflow nfacctd[1441]: DEBUG ( /etc/pmacct/networks.def ): (networks table IPv4) AS: 0, net: 80750000, mask (bit): ffff0000, mask (num): 10 Feb 22 12:07:07 testflow nfacctd[1441]: DEBUG ( /etc/pmacct/networks.def ): IPv4 Networks Cache successfully created: 99991 entries. Feb 22 12:07:07 testflow nfacctd[1441]: DEBUG ( /etc/pmacct/networks.def ): (networks table IPv6) AS: 0, net: 0:0:0:0, mask (bit): 0:0:0:0, mask (num): 0 Feb 22 12:07:07 testflow nfacctd[1441]: DEBUG ( /etc/pmacct/networks.def ): IPv6 Networks Cache successfully created: 32771 entries. Feb 22 12:07:07 testflow nfacctd[1441]: DEBUG ( ucar_in/memory ): allocating a new memory segment. Feb 22 12:07:07 testflow nfacctd[1437]: DEBUG ( /etc/pmacct/networks.def ): (networks table IPv4) AS: 0, net: 80750000, mask (bit): ffff0000, mask (num): 10 Feb 22 12:07:07 testflow nfacctd[1443]: DEBUG ( /etc/pmacct/networks.def ): (networks table IPv4) AS: 0, net: 80750000, mask (bit): ffff0000, mask (num): 10 Feb 22 12:07:07 testflow nfacctd[1437]: DEBUG ( /etc/pmacct/networks.def ): IPv4 Networks Cache successfully created: 99991 entries. Feb 22 12:07:07 testflow nfacctd[1443]: DEBUG ( /etc/pmacct/networks.def ): IPv4 Networks Cache successfully created: 99991 entries. Feb 22 12:07:07 testflow nfacctd[1443]: DEBUG ( /etc/pmacct/networks.def ): (networks table IPv6) AS: 0, net: 0:0:0:0, mask (bit): 0:0:0:0, mask (num): 0 Feb 22 12:07:07 testflow nfacctd[1437]: DEBUG ( /etc/pmacct/networks.def ): (networks table IPv6) AS: 0, net: 0:0:0:0, mask (bit): 0:0:0:0, mask (num): 0 Feb 22 12:07:07 testflow nfacctd[1437]: DEBUG ( /etc/pmacct/networks.def ): IPv6 Networks Cache successfully created: 32771 entries. Feb 22 12:07:07 testflow nfacctd[1443]: DEBUG ( /etc/pmacct/networks.def ): IPv6 Networks Cache successfully created: 32771 entries. Feb 22 12:07:07 testflow nfacctd[1437]: INFO ( default/core ): waiting for NetFlow data on :::9992 Feb 22 12:07:07 testflow nfacctd[1443]: DEBUG ( ucar_out/memory ): allocating a new memory segment. Feb 22 12:07:07 testflow nfacctd[1441]: DEBUG ( ucar_in/memory ): allocating a new memory segment. Feb 22 12:07:07 testflow nfacctd[1441]: OK ( ucar_in/memory ): waiting for data on: '/tmp/pmacct_in.pipe' Feb 22 12:07:07 testflow nfacctd[1443]: DEBUG ( ucar_out/memory ): allocating a new memory segment. Feb 22 12:07:07 testflow nfacctd[1443]: OK ( ucar_out/memory ): waiting for data on: '/tmp/pmacct_out.pipe' Feb 22 12:07:07 testflow nfacctd[1443]: DEBUG ( ucar_out/memory ): Selecting bucket 6355. Feb 22 12:07:07 testflow nfacctd[1437]: INFO: connection lost to 'ucar_out-memory'; closing connection. Feb 22 12:07:13 testflow nfacctd[1441]: DEBUG ( ucar_in/memory ): Selecting bucket 6355. Feb 22 12:07:20 testflow nfacctd[1437]: INFO: connection lost to 'ucar_in-memory'; closing connection. Feb 22 12:07:20 testflow nfacctd[1437]: INFO: no more plugins active. Shutting down. ================================================================================================ If I comment out the bgp_agent_map config key, then nfacctd will start, establish a bgp session, and process netflow data, however, all the AS numbers are listed as '0' (presumably because the IP address of the bgp feed doesn't match the IP address of the netflow feed). Any thoughts on how to resolve this would be greatly appreciated. Thanks, --paul _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
