No problem! If you feel like RTFM :), check out the official examples http://wiki.pmacct.net/OfficialExamples under Section XVII - Using pmacct as traffic/event logger; they have some initial information that can be used. It took me a little trial and error to figure it out.
Robert Juric On Tue, Apr 19, 2016 at 9:49 AM, Dariush Marsh-Mossadeghi < dari...@gravitas.co.uk> wrote: > Ahhhh… aggregating on something which can’t be aggregated. Nice hack :-) > Thanks Robert > > On 19 Apr 2016, at 15:26, Robert Juric <robert.ju...@gmail.com> wrote: > > I found you have to build the tables with timestamps and then when you > aggregate with timestamp_start and timestamp_end you can get the individual > flow records as opposed to aggregating the records. > > Robert Juric > > > > On Tue, Apr 19, 2016 at 9:00 AM, Dariush Marsh-Mossadeghi < > dari...@gravitas.co.uk> wrote: > >> Hi List, >> >> Is there a way to get pmacctd/nfacctd to NOT do any aggregation of flow >> records ? >> >> Specifically, I’ve got IPFIX coming off a router being handed by nfacctd >> and it would be useful to temporarily have visibility of every flow record. >> Tcpdump is not a suitable as part of what I’m trying to ascertain is >> whether the IPFIX data is accurate. >> >> Any suggestions/recipes/config snippets/pointers to RTFM would be >> gratefully received. >> >> Thanks >> Dariush >> > > > _______________________________________________ > pmacct-discussion mailing list > http://www.pmacct.net/#mailinglists >
_______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
