Hi Adam, Reading about your problem, i'm at a loss too. Can you please further refine the issue by looking, say with tcpdump, what gets replicated? Maybe we discover one of the two plugins stops teeing alltogether? What pmacct version are you using?
Cheers, Paolo On Thu, May 07, 2015 at 04:49:48PM +0200, Adam Bogdan wrote: > Hi, > > I have some odd problem > This is what I have - Juniper router with logical-systems - I have some > routes (BGP sessions) in primary routing table (non LS) and different > routing table in one logical-system. > I set up a BGP sessions from pmacct to both "routers" (non-LS and LS). > Juniper export all flows with IP address from non-LS - because I need to > resolve flows based on BGP in LS I'm doing this like this: > flows are send to IP e.g. a.a.a.a on port 3000 from there I replicate flows > to 127.0.0.1 to ports 5000 and 6000 > Then I run two tee plugins with this configuration: > nfacctd_port: 7000 > nfacctd_ip: 127.0.0.1 > > plugins: tee[lo5] > > tee_receiver[lo5]: b.b.b.b:2001 > tee_source_ip[lo5]: c.c.c.c > tee_transparent[lo5]: false > > and second config: > nfacctd_port: 6000 > nfacctd_ip: 127.0.0.1 > > plugins: tee[lo6] > > tee_receiver[lo6]: b.b.b.b:2001 > tee_transparent[lo6]: true > > Small explanation for above - flows from Juniper are replicated to ports > above (5000 and 6000) and from them I send them to pmacct (b.b.b.b) - for > lo5 I change IP address for IP from LS (c.c.c.c) and for lo6 I leave it > unchanged (IP from non-LS) > now on pmacct machine I get two exactly the same flows but visible as sent > from two machines (to this point everything looks fine, I even checked > packets send from Juniper to tee and then sent to pmacct (iptables > counters) and it looks fine) > > The problem - when I enable only tee[lo5] I get proper traffic value on > pmacct but when I enable tee[lo6] then traffic which I get in graphite > instantly drop > Here You can see how it looks like: http://postimg.org/image/zb9u1ywaj/ > To 21:00 I get some traffic (enabled tee[lo5] and tee[lo6]) after 21:00 I > disabled tee[lo6] and traffic instantly increased to the proper value - > after 22:00 enabled tee[lo6] again > > The problem is exactly the same if I enable/disable tee[lo5] - then on > tee[lo6] traffic value increase or deacrease > > I'm sitting on this second days and no idea where to search - nfacctd > config file on pmacct machine should be ok - beacause it's working for > others flows which I get from other routers > > This is screen from today: http://postimg.org/image/6qgd4sztj/ - after > 16:00 I enabled one of tee > In pmacct logs there are no errors - I even enabled debug for one of > plugins: > May 07 16:43:01 DEBUG ( DATA1/mysql ): 975 VALUES statements sent to the > MySQL server. > May 07 16:43:01 INFO ( DATA1/mysql ): *** Purging cache - END (PID: 2502, > QN: 975/975, ET: 0) *** > Only when I get data from sql - there is a big difference between 15:54 and > 16:08 > > Anyone have any idea where to search ? > > Best regards > Adam Bogdan > _______________________________________________ > pmacct-discussion mailing list > http://www.pmacct.net/#mailinglists _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
