Hi Terry,
It is possible that your sFlow exporter captures vlan info (which your NetFlow exporter does not). In which case the filter should be modified to reflect that. See: https://github.com/pmacct/pmacct/blob/master/QUICKSTART#L2466-#L2497 And more specifically this: https://github.com/pmacct/pmacct/blob/master/QUICKSTART#L2487-#L2491 Paolo On Sat, Oct 13, 2018 at 08:44:33PM +0000, Terry Duchcherer wrote: > I have been banging my head against a wall all day on this problem. > > I have two identical configuration files, 1 for nfacctd and 1 for sfacctd. > Only difference is the port info they listen to. > > nfacctd works perfect with the configuration, sfacctd does not. > > Here is the config: > > nfacct_port: 2055 or sfacctd_port: 6343 (Depends on which service I start) > plugins: mysql[inbound], mysql[outbound] > sqldb: pmacct > sql_host: localhost > sql_user: pmacct > sql_passwd: ********** > sql_table[inbound]: acct_in > sql_table[outbound]: acct_out > aggregate[inbound]: dst_host > aggregate[outbound]: src_host > aggregate_filter[inbound]: dst net (nn.nn.nn.nn/22 or nn.nn.nn.nn/22 or > nn.nn.nn.nn/21) > aggregate_filter[outbound]: src net (nn.nn.nn.nn/22 or nn.nn.nn.nn/22 or > nn.nn.nn.nn/21) > sql_refresh_time: 60 > sql_history: 1M > sql_history_roundoff: h > > nfacctd works perfectly, one line for each host in both mysql tables. > > sfacctd nothing wrote to the mysql tables. > If I comment out the two aggregate_filter lines, lots of data wrote to the > mysql tables including the subnets I want to aggregate. > > What could the possible difference be between nfacctd and sfacctd? > > Thanks in Advance; > Terry > > > > > _______________________________________________ > pmacct-discussion mailing list > http://www.pmacct.net/#mailinglists _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
