Hi, I have some odd problem This is what I have - Juniper router with logical-systems - I have some routes (BGP sessions) in primary routing table (non LS) and different routing table in one logical-system. I set up a BGP sessions from pmacct to both "routers" (non-LS and LS). Juniper export all flows with IP address from non-LS - because I need to resolve flows based on BGP in LS I'm doing this like this: flows are send to IP e.g. a.a.a.a on port 3000 from there I replicate flows to 127.0.0.1 to ports 5000 and 6000 Then I run two tee plugins with this configuration: nfacctd_port: 7000 nfacctd_ip: 127.0.0.1
plugins: tee[lo5] tee_receiver[lo5]: b.b.b.b:2001 tee_source_ip[lo5]: c.c.c.c tee_transparent[lo5]: false and second config: nfacctd_port: 6000 nfacctd_ip: 127.0.0.1 plugins: tee[lo6] tee_receiver[lo6]: b.b.b.b:2001 tee_transparent[lo6]: true Small explanation for above - flows from Juniper are replicated to ports above (5000 and 6000) and from them I send them to pmacct (b.b.b.b) - for lo5 I change IP address for IP from LS (c.c.c.c) and for lo6 I leave it unchanged (IP from non-LS) now on pmacct machine I get two exactly the same flows but visible as sent from two machines (to this point everything looks fine, I even checked packets send from Juniper to tee and then sent to pmacct (iptables counters) and it looks fine) The problem - when I enable only tee[lo5] I get proper traffic value on pmacct but when I enable tee[lo6] then traffic which I get in graphite instantly drop Here You can see how it looks like: http://postimg.org/image/zb9u1ywaj/ To 21:00 I get some traffic (enabled tee[lo5] and tee[lo6]) after 21:00 I disabled tee[lo6] and traffic instantly increased to the proper value - after 22:00 enabled tee[lo6] again The problem is exactly the same if I enable/disable tee[lo5] - then on tee[lo6] traffic value increase or deacrease I'm sitting on this second days and no idea where to search - nfacctd config file on pmacct machine should be ok - beacause it's working for others flows which I get from other routers This is screen from today: http://postimg.org/image/6qgd4sztj/ - after 16:00 I enabled one of tee In pmacct logs there are no errors - I even enabled debug for one of plugins: May 07 16:43:01 DEBUG ( DATA1/mysql ): 975 VALUES statements sent to the MySQL server. May 07 16:43:01 INFO ( DATA1/mysql ): *** Purging cache - END (PID: 2502, QN: 975/975, ET: 0) *** Only when I get data from sql - there is a big difference between 15:54 and 16:08 Anyone have any idea where to search ? Best regards Adam Bogdan
_______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
