Hi Mathias,

Inline:

On Tue, Aug 29, 2017 at 05:00:34PM +0200, Mathias Gumz wrote:
> > Currently I have set the "sql_history" and "sql_refresh_time" to 60s. I 
> > wonder,
> > how the algorithm works. "sql_refresh_time" seems to scan the cache and, if
> > needed, writes/updates an entry in the current bin. But what exactly is
> > "sql_history" doing? Will there be only "one" entry of a certain flow which 
> > is

Essentially sql_history makes stamp_inserted being added to the key. So,
yes, this will ensure only "one" entry for a certain aggregate during
the time-bin. 

> Also: currently I am trying to write to a new table every hour. So, I have 
> tables events0, events1, events2 etc. I have established a SSH-session which 
> crosses the full hour (which started 00:55 and ends 01:05). I received the 
> NAT event 4 for the created TCP connection in events0. The closing event (NAT 
> event 5) for the session is also stored in events0. My expectation is 
> events1. Why is that?

You have tables events0, events1, events2, etc.: is that the actual name
of the tables or just an example where 1, 2, etc. should be replaced by
a timestamp filled in by pmacct? Also, basing on what assumption would
you expect one event to go in events0, the other going in events1? Based
on time? 

Paolo


_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists

Reply via email to