I'm actually testing pmacct tools for a potential integration into our system to perform billing operations . So it is important for us to get the most accurate information from these tools. so i run sfacctd and pmacctd on a local machine with host sflow configured with the ULOG facility to collect traffic samples with a sampling rate 1 in 100. i used to following configuration within sfacctd :
daemonize: true plugins: memory[ins], memory[outs] interface: eth0 sfacctd_ip: 192.168.42.226 sfacctd_port: 6343 sfacctd_renormalize: true aggregate[ins]: dst_host aggregate_filter[ins]: src net 173.194.0.0/16 aggregate[outs]: src_host aggregate_filter[outs]: dst net 173.194.0.0/16 imt_path[ins]: /tmp/pmacct_ins.pipe imt_path[outs]: /tmp/pmacct_outs.pipe ! and the following for pmacctd : daemonize: true plugins: memory[in], memory[out] interface: eth0 aggregate[in]: dst_host aggregate_filter[in]: src net 173.194.0.0/16 aggregate[out]: src_host aggregate_filter[out]: dst net 173.194.0.0/16 imt_path[in]: /tmp/pmacct_in.pipe imt_path[out]: /tmp/pmacct_out.pipe ! the problem is that i found a big difference between these two tools : sfacctd shows : DST_IP PACKETS BYTES 192.168.42.226 1600 354000 and pmacctd shows : DST_IP PACKETS BYTES 192.168.42.226 1718 1096303 thanks for any remarque or suggestion and for help :) cheers. -- *SARHRAOUI Oussama *
_______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
