This seems to have solved the problem. I would have never looked for this as 
there are no vlans on the interfaces where sFlow is enabled.

Thanks very much for the info;
Terry


-----Original Message-----
From: pmacct-discussion <pmacct-discussion-boun...@pmacct.net> On Behalf Of 
Paolo Lucente
Sent: Sunday, October 14, 2018 2:47 AM
To: pmacct-discussion@pmacct.net
Subject: Re: [pmacct-discussion] sfacctd aggregate_filter problems


Hi Terry,

It is possible that your sFlow exporter captures vlan info (which your NetFlow 
exporter does not). In which case the filter should be modified to reflect 
that. See:

https://github.com/pmacct/pmacct/blob/master/QUICKSTART#L2466-#L2497

And more specifically this:

https://github.com/pmacct/pmacct/blob/master/QUICKSTART#L2487-#L2491 

Paolo
 
On Sat, Oct 13, 2018 at 08:44:33PM +0000, Terry Duchcherer wrote:
> I have been banging my head against a wall all day on this problem.
> 
> I have two identical configuration files, 1 for nfacctd and 1 for sfacctd. 
> Only difference is the port info they listen to.
> 
> nfacctd works perfect with the configuration, sfacctd does not.
> 
> Here is the config:
> 
> nfacct_port: 2055 or sfacctd_port: 6343 (Depends on which service I 
> start)
> plugins: mysql[inbound], mysql[outbound]
> sqldb: pmacct
> sql_host: localhost
> sql_user: pmacct
> sql_passwd: **********
> sql_table[inbound]: acct_in
> sql_table[outbound]: acct_out
> aggregate[inbound]: dst_host
> aggregate[outbound]: src_host
> aggregate_filter[inbound]: dst net (nn.nn.nn.nn/22 or nn.nn.nn.nn/22 
> or nn.nn.nn.nn/21)
> aggregate_filter[outbound]: src net (nn.nn.nn.nn/22 or nn.nn.nn.nn/22 
> or nn.nn.nn.nn/21)
> sql_refresh_time: 60
> sql_history: 1M
> sql_history_roundoff: h
> 
> nfacctd works perfectly, one line for each host in both mysql tables.
> 
> sfacctd nothing wrote to the mysql tables.
> If I comment out the two aggregate_filter lines, lots of data wrote to the 
> mysql tables including the subnets I want to aggregate.
> 
> What could the possible difference be between nfacctd and sfacctd?
> 
> Thanks in Advance;
> Terry
> 
> 
> 
> 

> _______________________________________________
> pmacct-discussion mailing list
> http://www.pmacct.net/#mailinglists


_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists

_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists

Reply via email to