You can make nfacctd use as timestamp the time the flow is received by
setting 'nfacctd_time_new: true'.
I'm not entirely clear on the second question though; in an ideal world,
where you have a different sampling rate per port and your device does
report that correctly via NetFlow options, having "nfacctd_renormalize:
true" should do the magics. Alternatively, you can define a sampling_map
up to the interface granularity.
On Thu, Jun 15, 2017 at 05:12:33PM -0400, Stephen Fulton wrote:
> Hi all,
> I'm working with netflow v9 exporting L2 flows and I can't figure
> out how to attach a proper timestamp to the flows as they are
> collected by nfacctd. In addition, due to some hardware limitations
> per port, I have different netflow sample rates, and I'm curious if
> the v9 options record which includes sample rates in every netflow
> packet nfacctd would receive or if it sent separately?
> -- Stephen
> pmacct-discussion mailing list
pmacct-discussion mailing list