Hi Alexandre,

Renormalization is a feature available only with collection (not teeing,
since teeing does no or very minimal parsing). I am curious, are you using
some sort of variable sampling rate or is it a constant? Perhaps you see
where i am going to - if constant, you could perhaps factor it in at
some point in your post processing. 

Paolo
  
On Wed, Sep 04, 2019 at 04:41:15PM +0200, alexandre wrote:
> Hello,
> 
> We are currently using exporting Netflow data to multiple Netflow
> collectors using the tee plugin along with nfacctd. The problem is that
> we are sampling our flows, and some collectors don't offer the
> possibility to correct the values.
> 
> I saw that nfacctd had some parameters that could correct the data (like
> renormalize) and I would like to use it to correct my sampled Netflow
> before exporting it with the tee plugin, but I still get the sampled
> values.
> 
> We are using Netflow v9 and the sampling value is not sent by the router.
> 
> Here is an example of the .conf file I use for nfacctd :
> 
> nfacctd_port: 2100
> nfacctd_ip: 0.0.0.0
> nfacctd_renormalize: true
> nfacctd_ext_sampling_rate: 1024
> !
> plugins: tee[br01]
> tee_receivers[br01]: /var/pmacct/tee_br01.lst
> !
> !pre_tag_map: /path/to/pretag.map
> !
> plugin_buffer_size: 10240
> plugin_pipe_size: 1024000
> nfacctd_pipe_size: 1024000
> 
> Do you have any suggestion about it ?
> 
> Many thanks
> 
> 
> _______________________________________________
> pmacct-discussion mailing list
> http://www.pmacct.net/#mailinglists

_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists

Reply via email to