Paul, We've hacked a version of FlowScan that does exactly that, it builds per-host RRD files for bandiwidth reporting. I'll be happy to send it to you if you want it; it's just a modified SubnetIO.pm file. Email me off-list and I'll send it to you. You have to have CFlowd and FlowScan working properly first.
One BIG caveat: If you have a LOT of IP addresses that are showing up in the file, it can make Flowscan take a long time to run, and if you start them with crontab, and start a new one before the last one is done, you can easily munge the memory on the box with runaway flowscan files. We ate half a gig of RAM before we figured that one out. You should use a shell script or similar to avoid starting Flowscan if there is an instance already running. Don't worry about missing data; it'll catch up eventually once your traffic slows down a bit and the number of flows to process drops off. Also, the per-host RRD's have different RRA names than the per-protocol ones that Flowscan generates; a quick RRDdump should show you what I mean. -- Unsubscribe mailto:[EMAIL PROTECTED] Help mailto:[EMAIL PROTECTED] Archive http://www.ee.ethz.ch/~slist/rrd-users WebAdmin http://www.ee.ethz.ch/~slist/lsg2.cgi
