Hi Alexandre,
Renormalization is a feature available only with collection (not teeing, since teeing does no or very minimal parsing). I am curious, are you using some sort of variable sampling rate or is it a constant? Perhaps you see where i am going to - if constant, you could perhaps factor it in at some point in your post processing. Paolo On Wed, Sep 04, 2019 at 04:41:15PM +0200, alexandre wrote: > Hello, > > We are currently using exporting Netflow data to multiple Netflow > collectors using the tee plugin along with nfacctd. The problem is that > we are sampling our flows, and some collectors don't offer the > possibility to correct the values. > > I saw that nfacctd had some parameters that could correct the data (like > renormalize) and I would like to use it to correct my sampled Netflow > before exporting it with the tee plugin, but I still get the sampled > values. > > We are using Netflow v9 and the sampling value is not sent by the router. > > Here is an example of the .conf file I use for nfacctd : > > nfacctd_port: 2100 > nfacctd_ip: 0.0.0.0 > nfacctd_renormalize: true > nfacctd_ext_sampling_rate: 1024 > ! > plugins: tee[br01] > tee_receivers[br01]: /var/pmacct/tee_br01.lst > ! > !pre_tag_map: /path/to/pretag.map > ! > plugin_buffer_size: 10240 > plugin_pipe_size: 1024000 > nfacctd_pipe_size: 1024000 > > Do you have any suggestion about it ? > > Many thanks > > > _______________________________________________ > pmacct-discussion mailing list > http://www.pmacct.net/#mailinglists _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
