Hi Steve, Try setting 'nfacctd_time_new: true' which would take as reference time of arrival of the flow to the collector; you should get your desired behaviour. Another solution is to keep nfacctd_time_new to false and decrease to the minimum the active timeout on your NetFlow exporter (what is happening now is that some long-lived flows is being trapped at the exporter long time before being exported to the collector).
Cheers, Paolo On Wed, Jul 27, 2016 at 11:30:47AM -0400, Stephen Clark wrote: > Hi List, > > Maybe someone can point out what I am doing wrong. I am trying to > get nfacctd to only do inserts and not do updates > but my data looks like it is still doing updates, see row from pgsql below: > tag | ip_src | ip_dst | port_src | port_dst | > ip_proto | tos | packets | bytes | stamp_inserted | > stamp_updated | id | agent_id > -----+-----------------+-----------------+----------+----------+----------+-----+---------+-----------+---------------------+---------------------+---------+---------- > 0 | 172.24.110.112 | 19x.xx.xxx.xx | 60391 | 443 | 6 > | 0 | 8 | 328 | 2016-07-27 10:55:00 | 2016-07-27 > 11:10:01 | 1313720 | 246 > > Notice stamp_inserted and stamp_updated - I would expect them to be > the same if the pgsql plugin was only doing inserts. > > Here is my config. > > daemonize: true > debug: false > pidfile: /var/run/nfacctd.pid > syslog: daemon > !logfile: /home/arodriguez/pmacct/pmacct-1.5.3/logfile > pre_tag_map: ./my.pretag.map > nfacctd_disable_checks: false > > nfacctd_time_new: false > > aggregate: tag, src_host, dst_host, src_port, dst_port, proto, tos > > > plugin_pipe_size: 4096000 > plugin_buffer_size: 4096 > > plugins: pgsql > > sql_table: acct_uni_custom > sql_data: typed > > !sql_multi_values: 512000 > sql_dont_try_update: true > sql_use_copy: true > sql_db: pmacct > sql_host: 127.0.0.1 > sql_passwd: arealsmartpwd > sql_user: pmacct > sql_refresh_time: 300 > sql_optimize_clauses: true > sql_history: 5m > sql_history_roundoff: m > sql_recovery_logfile: /var/lib/pmacct/recovery_log > !sql_table_version: 9 > sql_preprocess: qnum=1000, minp=5 > sql_locking_style: row > sql_cache_entries: 199999 > > imt_buckets: 65537 > imt_mem_pools_size: 1024000 > > nfacctd_port: 2055 > !nfacctd_ip: 127.0.0.1 > !nfacctd_time_new: true > !nfacctd_allow_file: /etc/pmacct/allow > > Any clarification would be appreciated. > > Thanks, > Steve > > _______________________________________________ > pmacct-discussion mailing list > http://www.pmacct.net/#mailinglists _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
