Hi Vito, Inline:
On Wed, May 08, 2013 at 06:50:43PM +0200, [email protected] wrote: > [ .. ] > > 1) is possible to have a roundoff value as milliseconds? Can you elaborate on this? sql_history (temporal aggregation feature) stops to seconds resolution. You looking for sub-second temporal aggregation? > 2) it is possible to aggregate the rows belonging to the same long > connections, is there any timeout I can use? You have setup sql_history (temporal aggregation) to 1 hour: you mean to aggregate together rows belonging to long connections that last more than one hour? > 3) why the ip_proto fields is always empty? All seems good with your configuration. It should just work. Can you spot any complains when you start pmacctd up or by checking logs? If neither of these give any clue, since you are capturing over a bridge (which means bridged interface, ie. br0 or so?) can you send over a brief capture in libpcap/tcpdump format so to double-check this out? > 4) there is a way to fill -1 in the valn fields when a untagged packet > is found? No. Is there a specific reason against a value of zero to designate an untagged packet? You can post-process yourself the table rewriting zeroes to -1 with a simple SQL query. > 5) is possible to remove the packets and bytes fields from the DB schema? No. Since pmacct is an IP accounting application this is not generally possible. More recently, 0.14.3, these fields can be removed in order to log down events, ie. Cisco NEL. What is the use-case for this request? > 6) can you suggest me keys to improve general performances I'd say the keys are specific to the most popular queries you want to run against the dataset - maybe you can elaborate on what you are trying to accomplish. Cheers, Paolo _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
