I see in the config keys for nfacctd that by default it checks sequence
numbers and will log an error if any are missing.
[ nfacctd_disable_checks | sfacctd_disable_checks ] [GLOBAL, NO_PMACCTD]
both nfacctd and sfacctd check health of incoming NetFlow/sFlow datagrams -
actually this is limited to just verifying sequence numbers progression.
You may want to disable such feature because of non-standard
implementations. By default checks are enabled
My question: what does that log message look like? I suspect I'm losing
flows and I want to check the logs for evidence. I looked in src/nfacctd.c
to see if I could tell what the syslog message would look like but I can't
figure out where it's checking the sequence numbers for continuity and
logging an error on lost data.
pmacct-discussion mailing list