Hi Daniel, It seems you are looking to add the following yo your config:
sfacctd_renormalize: true Paolo On Mon, Jun 12, 2017 at 03:39:30PM +0200, Daniel Swarbrick wrote: > Hi, > > Firstly, thanks for the excellent community support on pmacct! > > I have a question regarding how sfacctd counts packets for sFlow sampled > ethernet flows. I have written a simple sFlow agent in Python which is > scraping counters from a legacy, procfs-based counter source, and faking > sFlow sampled ethernet flows. I've diligently studied the sFlow spec, and > the faked samples look totally fine in sflowtool and Wireshark. Feeding > them to sfacctd is correctly counting the bytes, however the packet > counters are only monotonically incremented for each sample received. > > The sfacctd.conf is about as simple as can be for now: > > plugins: memory > aggregate: src_mac, dst_mac > > Dumping the in-memory counters: > > $ pmacct -s > SRC_MAC DST_MAC PACKETS BYTES > 00:de:ad:be:ef:00 00:00:00:00:00:00 270 219773 > 00:ca:fe:ba:be:00 00:00:00:00:00:00 249 202870 > 00:00:00:00:00:00 00:ca:fe:ba:be:00 249 192659 > 00:00:00:00:00:00 00:00:00:00:00:00 496 373114 > > The all-zeros MAC addresses are to indicate traffic direction (did I > mention this was legacy?), with all-zero-dst implying outbound, and > all-zero-src implying inbound. > > I have messed around with the sample pool size and sampling rate fields in > my sFlow agent, to no avail - sfacctd still seems to only increment the > packet counter by one for each sample received. I half expected that > sfacctd would interpolate the flows, so that if I sent one flow sample from > a pool of 500, with sampling rate = 1, it would increment the packet > counter by 500. I assumed that this would be how sfacctd would correctly > accumulate packet counters for a real vendor-supplied sFlow agent, which > was sampling e.g. 1 out of 1000 packets. > > We can live with byte counters only, since that is what we bill for, but it > would be nice to have packet counters too, so that we could calculate > average packet size (and spot high PPS sources). > > What am I missing here? > _______________________________________________ > pmacct-discussion mailing list > http://www.pmacct.net/#mailinglists _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
