Hi Andrey, 'nfacctd_account_options: true' is likely causing this. You should split flow records from options - since you would need different schemas for each. See the 'Va. NetFlow daemon & accounting NetFlow v9/IPFIX options' chapter in https://github.com/pmacct/pmacct/blob/master/QUICKSTART for that. See the role of tagging (pre_tag_map), filtering/splitting basing on the tag (pre_tag_filter) and the two plugin instances.
Paolo On Mon, Mar 26, 2018 at 08:37:43AM +0300, Andrey Koblyuk wrote: > Здравствуйте, Paolo. > > Вы писали 24 березня 2018 р., 21:55:46: > > > > Hi Andrey, > > > So there are some rows that contain empty ip addresses and this is > > causing the issue. I don't have a full vision of your config so i can > > not guess what could be the cause - please send it over. It could also > > be not a config issue but rather some flow spit by the exporting IPFIX > > device. > > Config: > > pidfile : /var/run/nfacctd.pid > nfacctd_port : 2205 > nfacctd_time_new : true > nfacctd_account_options : true > nfacctd_as : bgp > nfacctd_peer_as : bgp > > #debug:true > > bgp_daemon : true > bgp_stdcomm_pattern_to_asn : XXXXX:XXXXX > bgp_daemon_ip : YY.YY.YY.YY > > sql_db : pmacct > sql_host : localhost > sql_user : ZZZZZZZZZZZZ > sql_passwd : ZZZZZZZZZZZZ > > plugins : pgsql[storage] > > aggregate[storage] : > src_host,dst_host,src_port,dst_port,proto,src_as,dst_as,in_iface,out_iface,timestamp_start,timestamp_end > sql_optimize_clauses[storage] : true > sql_table[storage] : traffic_%d%m%Y > sql_table_schema[storage] : /etc/pmacct/nfacct_schema.psql > sql_table_type[storage] : bgp > sql_dont_try_update[storage] : true > sql_use_copy[storage] : true > sql_history[storage] : 1d > sql_history_roundoff[storage] : d > sql_cache_entries[storage] : 131084 > > > If this is a problem with the ipfix stream, is it possible to configure the > replacement of null values with 0.0.0.0? or somehow indicate the demon - so > that he ignores such flows? > > -- > ANK32-RIPE > _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
