Hi Paolo, Sorry for the long delay. After migrating to IPFIX (Netflow v10) I was able to export labels to nfacct and kafka. Everything is working perfectly. Thanks a lot for such expedite and efficient help.
Best regards, Bruno On Wed, Apr 24, 2024 at 8:58 AM Paolo Lucente <[email protected]> wrote: > > Hi Bruno, > > What version of pmacct are you using? Also, are you familiar with > tcpdump / wireshark tools? It would be the best way to confirm that the > extra info (label) is making in the output Netflow record; let me know > if you need help with that, here or by unicast email. > > Paolo > > > On 22/4/24 22:36, Bruno Agostinho (He Him) wrote: > > Hi Paolo, > > > > Thanks for the quick response. I've tried the way you said, adding a > > pre-tag map and label aggregation. I've tried the pre-tag map with > > label=hostname, and again with set_label=hostname label=hostname (this > > had been my first attempt). Still I can't get a netflow message with the > > hostname information. I don't want to jump to the nfacctd configuration > > without /seeing/ the label in the netflow messages. Does it make sense ? > > Please review what I might be doing wrong and where exactly in the > > netflow messages should we expect to have that label. > > > > Regards, > > > > Bruno > > > > On Fri, Apr 19, 2024 at 5:43 PM Paolo Lucente <[email protected] > > <mailto:[email protected]>> wrote: > > > > > > Hi Bruno, > > > > Yes you can use labels for that & i have just proofed that working > > successfully end-to-end (exporter and collector sides) on my local > > environment. > > > > In the nfprobe config: > > > > pre_tag_map: /path/to/pretag.map > > aggregate: label, < all other usual suspects here > > > > > Then in pretag.map, super simple: > > label=<hostname> > > > > You can craft one single label packing all you want, and separating > the > > info the way you like, ie. <hostname>_<instance>, or be fancy and > have > > multiple labels that then pmacct will concatenate for you -- > although i > > don't real see a point to complicate stuff like that. > > > > Hope this helps. > > > > Paolo > > > > > > On 18/4/24 18:23, Bruno Agostinho (He Him) wrote: > > > Hello All, > > > > > > I'm using pmacctd to export netflow messages to further > > processing in > > > centralized nfacctd's. I'd like to enrich netflow messages with > the > > > hostname (and possibly instance type). I've deduced from > > documentation > > > and other discussions that netflow protocol isn't designed to > > support > > > it. Hence nfprobe usage of tags and labels is restrained to > > manipulate > > > direction and ifindex fields. And to achieve what I want I'd need > > to use > > > a protocol other than netflow, like kafka. Please confirm my > > > understanding or, if I'm wrong, how this can be achieved (using > > tags and > > > labels or any other method). > > > > > > Thanks a lot in advance for any insight you can provide! > > > > > > Bruno > > > > > > _______________________________________________ > > > pmacct-discussion mailing list > > > http://www.pmacct.net/#mailinglists > > <http://www.pmacct.net/#mailinglists> > > >
_______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
