Re: [pmacct-discussion] monitoring multiple network interfaces
Hi Ross, This same setup works well on a Linux for example. I see you daemonize both pmacctd daemons. Can you please keep them in foreground instead (daemonize: false) so that you can catch what happens? Cheers, Paolo On Thu, Sep 23, 2010 at 01:06:58PM -0700, Ross Lawrie wrote: Hi, I'm trying to set pmacct up on an OpenBSD 4.7 server running PF for its firewall such that I can monitor traffic on each of my networks. From the articles I've read in the wiki and in mailing lists the easiest way to do this is to run multiple instances of pmacctd. The problem I'm having is that processes after the first one don't seem to generate data. For example, using the following two commands to start pmacctd: /usr/local/sbin/pmacctd -f /etc/pmacct/pmacctd_dmz.conf /usr/local/sbin/pmacctd -f /etc/pmacct/pmacctd_internal.conf Here are the associated config files: ! ! pmacctd_dmz.conf ! debug: false daemonize: true interface: em1 plugin_buffer_size: 2048 plugin_pipe_size: 2048000 networks_file: /etc/pmacct/networks.def plugins: memory[dmzin], memory[dmzout] aggregate[dmzin]: dst_host aggregate[dmzout]: src_host imt_path[dmzin]: /tmp/dmz-in.pipe imt_path[dmzout]: /tmp/dmz-out.pipe ! ! pmacct_internal.conf ! debug: false daemonize: true interface: ste0 plugin_buffer_size: 2048 plugin_pipe_size: 2048000 networks_file: /etc/pmacct/networks.def plugins: memory[intin], memory[intout] aggregate[intin]: dst_host aggregate[intout]: src_host imt_path[intin]: /tmp/internal-in.pipe imt_path[intout]: /tmp/internal-out.pipe Using pmacct -s -p pipe I'm able to see data for whichever I start first, however I get errors on the second started. Sometimes one or both of the pipes belonging to the second process aren't created, if they are created I get an error when trying to read from them: pmacct -s -p /tmp/dmz-out.pipe INFO: Connection refused while trying to connect to '/tmp/dmz-out.pipe' Hopefully someone can see whatever I'm missing here. The version of pmacct installed is 0.12.0 in case that's relevant. Thanks, Ross Lawrie ___ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists ___ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
Re: [pmacct-discussion] monitoring multiple network interfaces
Did you see my last mail paulo? Med venlig hilsen | Best regards Thomas Raabo Netværksansvarlig t...@zitcom.dk | Direkte: +45 69 10 60 18 | Tlf: +45 70 23 55 66 -Original Message- From: pmacct-discussion-boun...@pmacct.net [mailto:pmacct-discussion-boun...@pmacct.net] On Behalf Of Paolo Lucente Sent: 24. september 2010 02:23 To: r...@riverstyx.net; pmacct-discussion@pmacct.net Subject: Re: [pmacct-discussion] monitoring multiple network interfaces Hi Ross, This same setup works well on a Linux for example. I see you daemonize both pmacctd daemons. Can you please keep them in foreground instead (daemonize: false) so that you can catch what happens? Cheers, Paolo On Thu, Sep 23, 2010 at 01:06:58PM -0700, Ross Lawrie wrote: Hi, I'm trying to set pmacct up on an OpenBSD 4.7 server running PF for its firewall such that I can monitor traffic on each of my networks. From the articles I've read in the wiki and in mailing lists the easiest way to do this is to run multiple instances of pmacctd. The problem I'm having is that processes after the first one don't seem to generate data. For example, using the following two commands to start pmacctd: /usr/local/sbin/pmacctd -f /etc/pmacct/pmacctd_dmz.conf /usr/local/sbin/pmacctd -f /etc/pmacct/pmacctd_internal.conf Here are the associated config files: ! ! pmacctd_dmz.conf ! debug: false daemonize: true interface: em1 plugin_buffer_size: 2048 plugin_pipe_size: 2048000 networks_file: /etc/pmacct/networks.def plugins: memory[dmzin], memory[dmzout] aggregate[dmzin]: dst_host aggregate[dmzout]: src_host imt_path[dmzin]: /tmp/dmz-in.pipe imt_path[dmzout]: /tmp/dmz-out.pipe ! ! pmacct_internal.conf ! debug: false daemonize: true interface: ste0 plugin_buffer_size: 2048 plugin_pipe_size: 2048000 networks_file: /etc/pmacct/networks.def plugins: memory[intin], memory[intout] aggregate[intin]: dst_host aggregate[intout]: src_host imt_path[intin]: /tmp/internal-in.pipe imt_path[intout]: /tmp/internal-out.pipe Using pmacct -s -p pipe I'm able to see data for whichever I start first, however I get errors on the second started. Sometimes one or both of the pipes belonging to the second process aren't created, if they are created I get an error when trying to read from them: pmacct -s -p /tmp/dmz-out.pipe INFO: Connection refused while trying to connect to '/tmp/dmz-out.pipe' Hopefully someone can see whatever I'm missing here. The version of pmacct installed is 0.12.0 in case that's relevant. Thanks, Ross Lawrie ___ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists ___ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists ___ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
