Hi everyone,
pmacct starter here, trying to get pmacctd working inside of a container to
listen to the (container's) host's traffic. I suppose this is a, if not
the, standard use case for pmacctd in a container. So I'm sure it works in
principle but I'm doing something wrong.
Command for starting the container:
docker run \
--privileged --network=host \
--name pmacctd \
-v /tmp/pmacctd.conf:/etc/pmacct/pmacctd.conf:ro \
-v /tmp/pcap-itf.conf:/etc/pmacct/pcap-itf.conf:ro \
-v /tmp//captures:/var/pmacct/captures:rw pmacctd-debug \
pmacct/pmacctd:latest
Contents of pmacctd.conf:
daemonize: false
snaplen: 1000
pcap_interfaces_map: /etc/pmacct/pcap-itf.conf
aggregate: src_host, dst_host, src_port, dst_port, proto, class
plugins: print
print_output: json
print_output_file: /var/pmacct/captures/capture-%Y%m%d_%H%M.txt
print_output_file_append: true
print_history: 1m
print_history_roundoff: m
print_refresh_time: 5
pcap-itf.conf contains all interfaces of the host (as per netstat -i) in
the form
ifname=eno2
One line each, no other keys/values other than ifname.
Possibly important note: There's a VPN (openconnect) constantly running on
the host. The VPN's interface is listed in netstat -i and, as such,
included in pcap-itf.conf.
Starting the container yields this output:
INFO ( default/core ): Promiscuous Mode Accounting Daemon, pmacctd
1.7.7-git (20211107-0 (ef37a415))
INFO ( default/core ): '--enable-mysql' '--enable-pgsql'
'--enable-sqlite3' '--enable-kafka' '--enable-geoipv2' '--enable-jansson'
'--enable-rabbitmq' '--enable-nflog' '--enable-ndpi' '--enable-zmq'
'--enable-avro' '--enable-serdes' '--enable-redis' '--enable-gnutls'
'AVRO_CFLAGS=-I/usr/local/avro/include' 'AVRO_LIBS=-L/usr/local/avro/lib
-lavro' '--enable-l2' '--enable-traffic-bins' '--enable-bgp-bins'
'--enable-bmp-bins' '--enable-st-bins'
INFO ( default/core ): Reading configuration file
'/etc/pmacct/pmacctd.conf'.
INFO ( default/core ): [/etc/pmacct/pcap-itf.conf] (re)loading map.
INFO ( default/core ): [/etc/pmacct/pcap-itf.conf] map successfully
(re)loaded.
INFO ( default_print/print ): cache entries=16411 base cache
memory=67875896 bytes
INFO ( default_print/print ): JSON: setting object handlers.
INFO ( default_print/print ): *** Purging cache - START (PID: 7) ***
INFO ( default_print/print ): *** Purging cache - END (PID: 7, QN: 0/0,
ET: X) ***
Now, the problem is there are no files showing up in the 'captures'
directory at all.
I tried these things (as well as combinations thereof) to try to
understand what's going on:
* change the time related settings in pmacct.conf: to dump data more/less
often - also waited (increasingly) long, at times up to 20 minutes
* change 'snaplen' in pmacct.conf up & down - just to make sure I'm not
running into buffering problems (just guessing, haven't read pmacct/d
sources)
* change pcap-itf.conf to contain all interfaces or only the (host's) LAN +
VPN interfaces (removing all others like docker's internal 'docker0')
* check permission settings of the 'captures' directory - this should be
fine because a simple "touch /var/pmacct/captures/foobar" works and the
file does exist as observed in the directory on the host itself
* run the container _not_ in host-sniffing mode, so just inside its own
network-bubble, then cause traffic against it and observe it writing data
to the 'captures' directory - works!
Because I started to doubt my own sanity I asked one of our Docker/K8S
experts to check my docker setup and he found no problem looking over it,
including via "docker inspect pmacct". So I'm fairly sure my mistake is
somewhere in the configuration of pmacctd but I cannot figure out what is.
Would someone please point it out to me ?
Regards & Thanks,
Thomas
PS: It's been almost 10 years since I've posted to a mailing list. Please
forgive any conventions/best-practices missteps.
_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists
