I'm from Tuxis, a small ISP from the Netherlands. We run a small network, with 
three transits and one peering network. Our routers are Debian/Bird-based, and 
perform pretty well, if I may say so myself.

On each router, we run a pmacct per external interface. Primary goal is 
invoicing (through amqp), secondary goal is sFlow and Netflow for obvious 

I have sFlow sampling at 1:512 and all is working well there. Netflow however, 
is an issue.

We export Netflow to nprobe, and nprobe complains about Flow Collection Drops. 
And I can confirm that with Wireshark, which reports:
    FlowSequence: 889946358 (expected 888912934)
        [Expert Info (Warning/Sequence): Unexpected flow sequence for domain ID 
77 (expected 888912934, got 889946358)]
            [Unexpected flow sequence for domain ID 77 (expected 888912934, got 
            [Severity level: Warning]
            [Group: Sequence]

So it seems that pmacct is missing data on flows, probably due to my 
configuration. Two questions:

1: How can I see that pmacct buffers or buckets are overrunning?
2: Looking at my current configuration, which values should I alter to achieve 
both (mostly) complete flowdata and not too much CPU usage?

Thanks in advance, also for the cool product that pmacctd is!

daemonize: true
pidfile: /var/run/pmacctd.pid
syslog: daemon

interface: v-amsix

pmacctd_flow_buffer_size: 268435456 !256MB
pmacctd_flow_buffer_buckets: 65536
pmacctd_conntrack_buffer_size: 134217728 !128MB
pmacctd_flow_tcp_lifetime: 3600

plugins: nfprobe[in],nfprobe[out],sfprobe[fnm],amqp
plugin_buffer_size: 102400
plugin_pipe_size: 102400000

sampling_rate: 1
sampling_rate[fnm]: 512
timestamps_since_epoch: true
geoipv2_file: /var/lib/GeoIP/GeoLite2-Country.mmdb
aggregate: src_host_country, dst_host_country
amqp_exchange: pmacct
amqp_routing_key: acct
amqp_refresh_time: 300
amqp_history_roundoff: m
amqp_exchange_type: direct
amqp_persistent_msg: false
amqp_cache_entries: 262147
amqp_multi_values: 65536
amqp_history: 5m

sfprobe_agentsubid: 1402

nfprobe_version: 10
nfprobe_direction[in]: in
nfprobe_direction[out]: out
nfprobe_ifindex[in]: 77
nfprobe_ifindex[out]: 77
nfprobe_engine: 77

Mark Schouten <m...@tuxis.nl>

Tuxis, Ede, https://www.tuxis.nl

T: +31 318 200208 

pmacct-discussion mailing list

Reply via email to