Hi, I'm from Tuxis, a small ISP from the Netherlands. We run a small network, with three transits and one peering network. Our routers are Debian/Bird-based, and perform pretty well, if I may say so myself.
On each router, we run a pmacct per external interface. Primary goal is invoicing (through amqp), secondary goal is sFlow and Netflow for obvious reasons. I have sFlow sampling at 1:512 and all is working well there. Netflow however, is an issue. We export Netflow to nprobe, and nprobe complains about Flow Collection Drops. And I can confirm that with Wireshark, which reports: FlowSequence: 889946358 (expected 888912934) [Expert Info (Warning/Sequence): Unexpected flow sequence for domain ID 77 (expected 888912934, got 889946358)] [Unexpected flow sequence for domain ID 77 (expected 888912934, got 889946358)] [Severity level: Warning] [Group: Sequence] So it seems that pmacct is missing data on flows, probably due to my configuration. Two questions: 1: How can I see that pmacct buffers or buckets are overrunning? 2: Looking at my current configuration, which values should I alter to achieve both (mostly) complete flowdata and not too much CPU usage? Thanks in advance, also for the cool product that pmacctd is! daemonize: true pidfile: /var/run/pmacctd.pid syslog: daemon interface: v-amsix pmacctd_flow_buffer_size: 268435456 !256MB pmacctd_flow_buffer_buckets: 65536 pmacctd_conntrack_buffer_size: 134217728 !128MB pmacctd_flow_tcp_lifetime: 3600 plugins: nfprobe[in],nfprobe[out],sfprobe[fnm],amqp ! plugin_buffer_size: 102400 plugin_pipe_size: 102400000 sampling_rate: 1 sampling_rate[fnm]: 512 timestamps_since_epoch: true geoipv2_file: /var/lib/GeoIP/GeoLite2-Country.mmdb aggregate: src_host_country, dst_host_country aggregate: src_host,dst_host,src_port,dst_port,proto,src_mac,dst_mac,src_host_country,dst_host_country amqp_exchange: pmacct amqp_routing_key: acct amqp_refresh_time: 300 amqp_history_roundoff: m amqp_host: amqp_user: amqp_passwd: amqp_exchange_type: direct amqp_persistent_msg: false amqp_cache_entries: 262147 amqp_multi_values: 65536 amqp_history: 5m sfprobe_agentsubid: 1402 sfprobe_receiver: nfprobe_receiver: nfprobe_version: 10 nfprobe_source_ip: nfprobe_direction[in]: in nfprobe_direction[out]: out nfprobe_ifindex[in]: 77 nfprobe_ifindex[out]: 77 nfprobe_engine: 77 -- Mark Schouten <m...@tuxis.nl> Tuxis, Ede, https://www.tuxis.nl T: +31 318 200208
_______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists