Hi Paul, >From the log it appears the memory plugins bail out and then the core process closes nicely because it has no more plugins to pass data to. The aggregation method is short so it looks strange but is it possible there is very little memory available for the memory tables? The connection to the bgp_agent_map is precisely what you say: without it you have a single entry; with it you are properly populating the tables. Btw, is it a self-compiled executable?
Cheers, Paolo On Fri, Feb 22, 2013 at 02:32:22PM -0700, paul dial wrote: > Hi, > > I'm running pmacct-0.14.1 and attempting to setup a bgp feed. The > netflow feed is being tee'd from another process on the box so all the > netflow packets have a source IP address of 127.0.0.2. The bgp feed is > coming in from one of our routers. Here is a snippet from nfacctd.conf: > > daemonize: true > pidfile: /var/run/nfacctd.pid > syslog: daemon > ! > debug: true > ! > > aggregate[ucar_in]: src_as > aggregate_filter[ucar_in]: dst net 128.117.0.0/16 > aggregate[ucar_out]: dst_as > aggregate_filter[ucar_out]: src net 128.117.0.0/16 > > ! plugin_buffer_size: 1024 > nfacctd_port: 9992 > ! nfacctd_time_secs: true > nfacctd_time_new: true > plugins: memory[ucar_in], memory[ucar_out] > imt_path[ucar_out]: /tmp/pmacct_out.pipe > imt_path[ucar_in]: /tmp/pmacct_in.pipe > networks_file: /etc/pmacct/networks.def > > bgp_daemon: true > !bgp_daemon_msglog: true > bgp_daemon_ip: 192.XXX.XXX.XXX > bgp_daemon_max_peers: 100 > nfacctd_as_new: bgp > bgp_peer_src_as_type: bgp > bgp_src_as_path_type: bgp > bgp_src_local_pref_type: bgp > bgp_src_med_type: bgp > bgp_agent_map: /etc/pmacct/agent.map > > My agent.map looks like this: > id=<ip of bgp source> ip=127.0.0.2 > > When bgp_agent_map config key is used, nfacctd attempts to start but > then dies. Here are the log messages: > =================================================================================================== > Feb 22 12:07:02 testflow nfacctd[1437]: INFO ( default/core ): Start > logging ... > Feb 22 12:07:02 testflow nfacctd[1437]: INFO ( default/core ): Trying to > (re)load map: /etc/pmacct/agent.map > Feb 22 12:07:02 testflow nfacctd[1437]: INFO ( default/core ): map > '/etc/pmacct/agent.map' successfully (re)loaded. > Feb 22 12:07:02 testflow nfacctd[1437]: DEBUG ( default/core/BGP ): 1 > thread(s) initialized > Feb 22 12:07:02 testflow nfacctd[1437]: INFO ( default/core/BGP ): > maximum BGP peers allowed: 100 > Feb 22 12:07:02 testflow nfacctd[1437]: INFO ( default/core/BGP ): > waiting for BGP data on 1xx.xxx.xxx.xxx:179 > Feb 22 12:07:07 testflow nfacctd[1437]: INFO ( ucar_in/memory ): 131070 > bytes are available to address shared memory segment; buffer size is 216 > bytes. > Feb 22 12:07:07 testflow nfacctd[1437]: INFO ( ucar_in/memory ): Trying > to allocate a shared memory segment of 3538728 bytes. > Feb 22 12:07:07 testflow nfacctd[1437]: INFO ( ucar_out/memory ): 131070 > bytes are available to address shared memory segment; buffer size is 216 > bytes. > Feb 22 12:07:07 testflow nfacctd[1437]: INFO ( ucar_out/memory ): Trying > to allocate a shared memory segment of 3538728 bytes. > Feb 22 12:07:07 testflow nfacctd[1441]: DEBUG ( /etc/pmacct/networks.def > ): (networks table IPv4) AS: 0, net: 80750000, mask (bit): ffff0000, > mask (num): 10 > Feb 22 12:07:07 testflow nfacctd[1441]: DEBUG ( /etc/pmacct/networks.def > ): IPv4 Networks Cache successfully created: 99991 entries. > Feb 22 12:07:07 testflow nfacctd[1441]: DEBUG ( /etc/pmacct/networks.def > ): (networks table IPv6) AS: 0, net: 0:0:0:0, mask (bit): 0:0:0:0, mask > (num): 0 > Feb 22 12:07:07 testflow nfacctd[1441]: DEBUG ( /etc/pmacct/networks.def > ): IPv6 Networks Cache successfully created: 32771 entries. > Feb 22 12:07:07 testflow nfacctd[1441]: DEBUG ( ucar_in/memory ): > allocating a new memory segment. > Feb 22 12:07:07 testflow nfacctd[1437]: DEBUG ( /etc/pmacct/networks.def > ): (networks table IPv4) AS: 0, net: 80750000, mask (bit): ffff0000, > mask (num): 10 > Feb 22 12:07:07 testflow nfacctd[1443]: DEBUG ( /etc/pmacct/networks.def > ): (networks table IPv4) AS: 0, net: 80750000, mask (bit): ffff0000, > mask (num): 10 > Feb 22 12:07:07 testflow nfacctd[1437]: DEBUG ( /etc/pmacct/networks.def > ): IPv4 Networks Cache successfully created: 99991 entries. > Feb 22 12:07:07 testflow nfacctd[1443]: DEBUG ( /etc/pmacct/networks.def > ): IPv4 Networks Cache successfully created: 99991 entries. > Feb 22 12:07:07 testflow nfacctd[1443]: DEBUG ( /etc/pmacct/networks.def > ): (networks table IPv6) AS: 0, net: 0:0:0:0, mask (bit): 0:0:0:0, mask > (num): 0 > Feb 22 12:07:07 testflow nfacctd[1437]: DEBUG ( /etc/pmacct/networks.def > ): (networks table IPv6) AS: 0, net: 0:0:0:0, mask (bit): 0:0:0:0, mask > (num): 0 > Feb 22 12:07:07 testflow nfacctd[1437]: DEBUG ( /etc/pmacct/networks.def > ): IPv6 Networks Cache successfully created: 32771 entries. > Feb 22 12:07:07 testflow nfacctd[1443]: DEBUG ( /etc/pmacct/networks.def > ): IPv6 Networks Cache successfully created: 32771 entries. > Feb 22 12:07:07 testflow nfacctd[1437]: INFO ( default/core ): waiting > for NetFlow data on :::9992 > Feb 22 12:07:07 testflow nfacctd[1443]: DEBUG ( ucar_out/memory ): > allocating a new memory segment. > Feb 22 12:07:07 testflow nfacctd[1441]: DEBUG ( ucar_in/memory ): > allocating a new memory segment. > Feb 22 12:07:07 testflow nfacctd[1441]: OK ( ucar_in/memory ): waiting > for data on: '/tmp/pmacct_in.pipe' > Feb 22 12:07:07 testflow nfacctd[1443]: DEBUG ( ucar_out/memory ): > allocating a new memory segment. > Feb 22 12:07:07 testflow nfacctd[1443]: OK ( ucar_out/memory ): waiting > for data on: '/tmp/pmacct_out.pipe' > Feb 22 12:07:07 testflow nfacctd[1443]: DEBUG ( ucar_out/memory ): > Selecting bucket 6355. > Feb 22 12:07:07 testflow nfacctd[1437]: INFO: connection lost to > 'ucar_out-memory'; closing connection. > Feb 22 12:07:13 testflow nfacctd[1441]: DEBUG ( ucar_in/memory ): > Selecting bucket 6355. > Feb 22 12:07:20 testflow nfacctd[1437]: INFO: connection lost to > 'ucar_in-memory'; closing connection. > Feb 22 12:07:20 testflow nfacctd[1437]: INFO: no more plugins active. > Shutting down. > ================================================================================================ > > If I comment out the bgp_agent_map config key, then nfacctd will start, > establish a bgp session, and process netflow data, however, all the AS > numbers are listed as '0' (presumably because the IP address of the bgp > feed doesn't match the IP address of the netflow feed). > > Any thoughts on how to resolve this would be greatly appreciated. > > Thanks, > > --paul > > > _______________________________________________ > pmacct-discussion mailing list > http://www.pmacct.net/#mailinglists _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
