On Mon, 14 Dec 2015 13:33:36 +0000
Daniel Kopp <[email protected]> wrote:
> I don’t know an config switch to enable something like this in pmacct.
> And I believe this can’t be done while recording flows as you never
> know which traffic relation will become big beforehand :-)
>
> If your output is in json or csv format I would accomplish this by
> post processing the output files with awk.
>
> Here is an example:
> awk -F '[",:]' '{ if($(NF-12)>18801490000) print } input-file.json
> This would print only rows with a value greater than 18801490000.
>
> A possibly more elegant solution for your problem would be to sort
> the flows by size and then only print the top-n flows. You could use
> “sort -t, -n -r -k <column> <file> | head -n <rows>" to sort a csv
> file and print the top rows.
If you are storing data in PostgreSQL a "before" trigger
could be used to eliminate the rows you're not interested in
before they make it into the database.
Easiest of course, as mentioned, is to not look at what
you don't want to see. :-)
Regards,
Karl <[email protected]>
Free Software: "You don't pay back, you pay forward."
-- Robert A. Heinlein
_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists
