Hi Paolo,
Thank you, your aggregation method works. It seems I had misunderstood
the usefulness of the aggregation, as I thought it was just something to
play with the output but wouldn't change the fact that something is
effectively printed.
By the way, yes it was from an ASR1001, and it works very well.
Thank you,
Cheers,
Grégoire
Le 05/09/2013 21:25, Paolo Lucente a écrit :
Hi Gregoire,
The template looks allright, it contains NAT event among the other
things. From the template it would look like you are exporting from
ASR1K, ASA or similar - it would be great if you could confirm (as
i don't see TCP/UDP ports mentioned). Can you please try with a
different aggregation method:
src_host,post_nat_src_host,nat_event,timestamp_start
Let me know how it goes. It should work out of the box after, as
you said, you receive the first template. If not, please send me
privately a brief capture (including a template) of your NetFlow
so that i can investigate the issue - happy to do that.
Cheers,
Paolo
On Thu, Sep 05, 2013 at 01:33:10PM +0200, Grégoire Leroy wrote:
Hello,
I've setup pmacct 0.14.3 in order to log CGN NEL Cisco data. I can
see traffic with pmacct but not with nfacct. It is not a firewall
issue, as a debug command shows me that packet are processed :
(given that the length of the output, I've pastebined it)
http://bpaste.net/show/esBDqaWuYR0fbjsGgpoM/
(Note : contrary to what's written in the above output, at the end,
I don't have 3 times the same message, but 3 times the same kind of
messages i.e template).
Without debug I juste have :
# nfacctd -P print -r 10 -c src_host,dst_host
INFO ( default/core ): waiting for NetFlow data on 0.0.0.0:2100
SRC_IP DST_IP PACKETS BYTES
And nothing else.
Did I miss something here ? if I understand correctly it's normal
that at first, before the transmission of template I have nothing,
but then ? Why doesn't this command print anything ?
Thanks,
Regards,
Gregoire Leroy
_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists
_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists
_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists
