Hi Sergey, For template ID you mean flowset ID? If yes, then you can use a pre_tag_map and the flowset_id directive to tag session start/ session end differently. Then a pre_tag_filter can be used to direct different tags to different plugins, ie. because you want to log them in different files/DBs; alternatively, you can log all to the same file/DB ad make the tag visible (so to reckon a start from a stop) by adding the 'tag' keyword to the aggregation method configured by the 'aggregate' directive.
This is an example for the case of different files/DBs: nfacctd.conf: ... ! plugins: print[start], print[stop] ! pre_tag_map: /path/to/pretag.map ! pre_tag_filter[start]: 100 pre_tag_filter[stop]: 200 ! ... pretag.map: tag=100 flowset_id=X tag=200 flowset_id=Y Cheers, Paolo On Thu, Nov 19, 2015 at 08:46:31AM +0000, FOMIN, Sergey V (Sergey) wrote: > Hello, > > I've a question about filtering possibilities with nfacctd for IPFIX. > > If we need to use IPFIX for session start/session end accounting, we've 2 > templates coming from our routers with differents IDs & couple of different > fields (start has a flow start time, end has a flow end time & flow reason > (defined using primitives). > So my question is there any way to log them into different files/DB (based on > template ID or flowstart/flowend non-zero time)? Which aggregate_filter or > pre_map_tag should I use? > > Sergey V. Fomin > > _______________________________________________ > pmacct-discussion mailing list > http://www.pmacct.net/#mailinglists _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
