Hi Paolo,

Thanks for your answer.

We are currently using the same sampling rate for all our Netflow
sources so I will look for ways to process the data before passing it in
the tee plugin.

Alexandre

Le 05/09/2019 à 00:20, Paolo Lucente a écrit :
> Hi Alexandre,
>
> Renormalization is a feature available only with collection (not teeing,
> since teeing does no or very minimal parsing). I am curious, are you using
> some sort of variable sampling rate or is it a constant? Perhaps you see
> where i am going to - if constant, you could perhaps factor it in at
> some point in your post processing. 
>
> Paolo
>   
> On Wed, Sep 04, 2019 at 04:41:15PM +0200, alexandre wrote:
>> Hello,
>>
>> We are currently using exporting Netflow data to multiple Netflow
>> collectors using the tee plugin along with nfacctd. The problem is that
>> we are sampling our flows, and some collectors don't offer the
>> possibility to correct the values.
>>
>> I saw that nfacctd had some parameters that could correct the data (like
>> renormalize) and I would like to use it to correct my sampled Netflow
>> before exporting it with the tee plugin, but I still get the sampled
>> values.
>>
>> We are using Netflow v9 and the sampling value is not sent by the router.
>>
>> Here is an example of the .conf file I use for nfacctd :
>>
>> nfacctd_port: 2100
>> nfacctd_ip: 0.0.0.0
>> nfacctd_renormalize: true
>> nfacctd_ext_sampling_rate: 1024
>> !
>> plugins: tee[br01]
>> tee_receivers[br01]: /var/pmacct/tee_br01.lst
>> !
>> !pre_tag_map: /path/to/pretag.map
>> !
>> plugin_buffer_size: 10240
>> plugin_pipe_size: 1024000
>> nfacctd_pipe_size: 1024000
>>
>> Do you have any suggestion about it ?
>>
>> Many thanks
>>
>>
>> _______________________________________________
>> pmacct-discussion mailing list
>> http://www.pmacct.net/#mailinglists
> _______________________________________________
> pmacct-discussion mailing list
> http://www.pmacct.net/#mailinglists
_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists

Reply via email to