Hi,
We have a Palo Alto firewall and are trying to use pmacct to collect its
netflow data. I have been able to get everything to work for netflow v9 type
data expect for the timestamps. Most timestamps are current and some go back
one month. The wireshark trace of the netflow data does show such values in the
Timestamp field. When writing out the data to flat files the time goes back in
the past. That same data written to the mysql server is correct in terms of the
timestamp - todays date/time.
I have the following
nfacctd_time_new: true
which is apparently effective for the mysql side - but it appears not on the
file side...
file output
{"label": "netflow_fcnet_in_conv", "tcp_flags": "0", "application":
"bittorrent", "ip_src": "144.76.96.199", "port_src": 38914, "ip_dst":
"148.85.185.85", "port_dst": 41986, "timestamp_start": "2015-03-09 15:25:43.0",
"ip_proto": "udp", "timestamp_end": "2015-03-09 15:45:43.0", "username": "",
"packets": 4, "bytes": 409, "flows": 1}
Mysql output
ip_src ip_dst port_src port_dst tcp_flags ip_proto
packets bytes stamp_inserted stamp_updated country_ip_src country_ip_dst
username application
144.76.96.199 148.85.185.85 38914 41986 0 udp 4 409
4/1/2015 4:25:00 PM 4/1/2015 4:25:15 PM -- --
bittorrent
Steffen
_______________________________________________________________________________________________
Steffen Plotner Amherst College Tel (413)
542-2348
Systems/Network Administrator/Programmer PO BOX 5000 Fax (413)
542-2626
Systems & Networking Amherst, MA 01002-5000
[email protected]
_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists
