Hi Brian, Good. Another possible way i would have recommended is to not use a networks_file but an "aggregate_filter" directive per plugin: since these directives expect as argument a filter in libpcap/tcpdump format the amount of networks should be somehow limited. Alternatively you can achieve the same with pre_tag_map and pre_tag_filter combination: in the map you classify, then you filter based on the assigned tags.
The penalty in using the networks_file comes from having the ports in the aggregation methods. Cheers, Paolo On Tue, Mar 26, 2013 at 02:29:06PM -0400, Brian Rak wrote: > I ended up just writing a script to export the data via the memory > interface, filter the blank entries out, then insert it. I ended up > reducing the load on the system by a significant amount (because my > code isn't doing selects before trying to insert new rows). > > On 3/26/2013 10:42 AM, Brian Rak wrote: > >I'm using the following config file: > > > >daemonize: true > >sql_host: localhost > >sql_user: XXXXXX > >sql_passwd: XXXXXX > >sql_db: pmacct > >sql_table_version: 1 > >sql_refresh_time: 300 > >sql_history: 5m > >sql_history_roundoff: m > >sql_dont_try_update: true > >sql_table[incoming]: traffic_in > >sql_table[outgoing]: traffic_out > > > >networks_file: /etc/networks.list > > > >plugins: mysql[incoming], mysql[outgoing] > > > >aggregate[incoming]: dst_host, dst_port > >aggregate[outgoing]: src_host, src_port > > > >I'm trying to only record traffic stats for ip/port pairs on my > >local network. Prior to adding the networks_file line, I was > >seeing lots of inserted lines for remote hosts. With the > >networks_file line, I'm seeing lots of lines where both the ip_src > >and ip_dst columns are empty. Is there any way I can filter > >these? I really only care about traffic local to my machine. > > > >_______________________________________________ > >pmacct-discussion mailing list > >http://www.pmacct.net/#mailinglists > > > _______________________________________________ > pmacct-discussion mailing list > http://www.pmacct.net/#mailinglists _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
