Hi Steve, As Tim was mentioning you can use 'sampling_rate' with a fixed sample rate (not 'sample_rate'); this will make pmacct sample for you. In case you are sampling outside pmacct, you can supply this info via, say, pmacctd_ext_sampling_rate so that nfprobe will include such value in the NetFlow/IPFIX stream (so that you can then renormalize with the nfacctd_renormalize config directive at the receiving end).
Cheers, Paolo On Wed, Aug 24, 2016 at 11:06:27AM -0400, Stephen Clark wrote: > Hi Tim, > > My question is can nfprobe from pmacct package do the sampling at > the origination of the flow. > > Thanks, > Steve > > On 08/24/2016 10:55 AM, Tim Jackson wrote: > >If the probe is doing sampling, you can have pmacct re-normalize > >sampling via either a static sampling value, or via the flow/ipfix > >information that tells it how it was sampled.. > > > >sample_rate: <fixed sample rate> > >sample_map: <per-host sample rate map file> > >(s|n|p|u)facctd_renormalize:true > > > >If you're using a tap that samples traffic, you can tell the > >daemon that upstream traffic is sampled by X: > > > >pmacctd_ext_sampling_rate | uacctd_ext_sampling_rate > > > >http://wiki.pmacct.net/OfficialConfigKeys > > > >-- > >Tim > > > > > >On Wed, Aug 24, 2016 at 9:37 AM, Stephen Clark > ><[email protected] <mailto:[email protected]>> wrote: > > > > Hi Paolo, > > > > I looked thru the CONFIG_KEYS and didn't find the ability to do sampling > > except > > in the SQL_preprocess keys. Is it possible to do the sampling at the > > point > > the neflow records are first created - in other words by nfprobe? > > > > Thanks, > > Steve > > > > -- > > > > "They that give up essential liberty to obtain temporary safety, > > deserve neither liberty nor safety." (Ben Franklin) > > > > "The course of history shows that as a government grows, liberty > > decreases." (Thomas Jefferson) > > > > > > > > _______________________________________________ > > pmacct-discussion mailing list > > http://www.pmacct.net/#mailinglists <http://www.pmacct.net/#mailinglists> > > > > > > > -- > > "They that give up essential liberty to obtain temporary safety, > deserve neither liberty nor safety." (Ben Franklin) > > "The course of history shows that as a government grows, liberty > decreases." (Thomas Jefferson) > > > _______________________________________________ > pmacct-discussion mailing list > http://www.pmacct.net/#mailinglists _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
