I see in the config keys for nfacctd that by default it checks sequence numbers and will log an error if any are missing.
[ nfacctd_disable_checks | sfacctd_disable_checks ] [GLOBAL, NO_PMACCTD] Values [true|false] Desc both nfacctd and sfacctd check health of incoming NetFlow/sFlow datagrams - actually this is limited to just verifying sequence numbers progression. You may want to disable such feature because of non-standard implementations. By default checks are enabled (default: false) My question: what does that log message look like? I suspect I'm losing flows and I want to check the logs for evidence. I looked in src/nfacctd.c to see if I could tell what the syslog message would look like but I can't figure out where it's checking the sequence numbers for continuity and logging an error on lost data. Thanks, Ed
_______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
