Hi Mathias, Inline:
On Tue, Aug 29, 2017 at 05:00:34PM +0200, Mathias Gumz wrote: > > Currently I have set the "sql_history" and "sql_refresh_time" to 60s. I > > wonder, > > how the algorithm works. "sql_refresh_time" seems to scan the cache and, if > > needed, writes/updates an entry in the current bin. But what exactly is > > "sql_history" doing? Will there be only "one" entry of a certain flow which > > is Essentially sql_history makes stamp_inserted being added to the key. So, yes, this will ensure only "one" entry for a certain aggregate during the time-bin. > Also: currently I am trying to write to a new table every hour. So, I have > tables events0, events1, events2 etc. I have established a SSH-session which > crosses the full hour (which started 00:55 and ends 01:05). I received the > NAT event 4 for the created TCP connection in events0. The closing event (NAT > event 5) for the session is also stored in events0. My expectation is > events1. Why is that? You have tables events0, events1, events2, etc.: is that the actual name of the tables or just an example where 1, 2, etc. should be replaced by a timestamp filled in by pmacct? Also, basing on what assumption would you expect one event to go in events0, the other going in events1? Based on time? Paolo _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists