Re: [pmacct-discussion] input/output interface information innfacctd?

2009-06-15 Thread Suraj Nellikar (snellika) 
Hi,

 We also know that Netflow v9 is customizable. i.e I can define my own
 set of statistics to be exported to the collector. Is there a way to
 define the customized set in the pmacct (nfacct), so that nfacctd
 identifies those packets accordingly and stores it in the sql
database?
 Pre-tagging supports only a subset of these. 

Good point. I assume you mean you don't want to code in the customised
NetFlow v9 information (this would be easy given the modularity of this
part of the code) but rather you want to see in pmacct a way to define
customized information, via a configuration file, and then possibly
match them through the Pre-Tagging infrastructure. 

If this is the case, unfortunately, while being a good idea this is
not currently possible; i thought several times about it, not only in
terms of Pre-Tagging primitives but also more importantly in terms of
aggregation primitives. This is definitely in the radar but i have no
immediate plans of implementing this, being busy on other juicy things
for the upcoming 0.12 trunk. But hey, contributions are warmly welcome!

I was looking at the interface information in particular. I see that
pre-tag supports that but the problem here is I have to know the
interface numbers in advance to define rules in pre-tag config files. If
my network is huge, assuming I know my interface index numbers, the
config file will be huge if I have to identify each flow. So I was
planning to add the interface (in and out) into aggregation rules so
that it is listed in the sql database as part of the flow. Which c files
do I need to look into if I want to provide this support? 


Thanks,
Suraj.N


 -Original Message-
 From: pmacct-discussion-boun...@pmacct.net
 [mailto:pmacct-discussion-boun...@pmacct.net] On Behalf Of Karl O.
Pinc
 Sent: Monday, June 08, 2009 6:35 PM
 To: Paolo Lucente; pmacct-discussion@pmacct.net
 Subject: Re: [pmacct-discussion] input/output interface informationin
 nfacctd?
 
 
 On 06/08/2009 06:00:46 PM, Paolo Lucente wrote:
  Hi Suraj,
  
  This information is not immediately available within the
  database or memory table; but you can match such fields
  within the Pre-Tagging infrastructure to generate a tag
  - which can, in turn, be either just used internally for
  filtering or splitting data among the plugins or can be
  made available to the backend via the 'tag' aggregation
  primitive.
 
 Good summary of what tagging is for.  Is there a place
 to drop it on the wiki?
 
  
  See 'examples/pretag.map.example' in the pmacct tarball;
  also pre_tag_map and pre_tag_filter in the CONFIG-KEYS
  document.
  
  Cheers,
  Paolo
  
  
  On Mon, Jun 08, 2009 at 06:07:56PM -0400, Suraj Nellikar (snellika)
  wrote:
   Hi,
  
   Doesn't the pmacct collector (I am running nfacctd) provide the
  Input
   Interface,Output Interface information which is present in the
  Netflow
   packets?
  
  
  
   Thanks,
  
   Suraj.N
  
  
  ___
  pmacct-discussion mailing list
  http://www.pmacct.net/#mailinglists
  
  
 
 
 Karl k...@meme.com
 Free Software:  You don't pay back, you pay forward.
   -- Robert A. Heinlein
 
 ___
 pmacct-discussion mailing list
 http://www.pmacct.net/#mailinglists

___
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists

Re: [pmacct-discussion] input/output interface information innfacctd?

2009-06-15 Thread Suraj Nellikar (snellika) 
Hi,

 If I am understanding correctly here, the in and the out (input
and
 output interface) values defined in the pre-tag are the snmp index
 values of the interfaces on the switch/router right? I see that the
in
 and out being used here are defined as integers whereas the
interfaces
 being exported are hex values. Can we change the data type in pmacct?

Yes, that's correct. But how do you mean by interfaces are exported
as hex values?


I am trying to use pre_tag and I am running into some problems. I
defined a tag entry, where, all packets (in=-1) should be tagged with
id=100. It worked fine. I could see that all packets in mysql database
have agent_id=100. But when I am using a specific input interface value
(for ex. in=469762208), the nfacctd does not identify the packets
properly. I checked the if-index on the switch and it was a hex
value(1ca0). But nfacctd's pre_tag.map accepts only integers. So I
was wondering if that is the problem. Here is the nfacctd.conf:-

daemonize: false
plugins: mysql
aggregate: tag, src_host,dst_host,src_port,dst_port
nfacctd_port:5678
pre_tag.map: ./pre_tag.conf
sql_table_version: 2
nfacctd_sql_log: true
nfacctd_time_new: true

The pre_tag.conf has:-
id=200 ip=router ip in=469762208


Am I missing anything here?

Thanks,
Suraj.N

 -Original Message-
 From: pmacct-discussion-boun...@pmacct.net
 [mailto:pmacct-discussion-boun...@pmacct.net] On Behalf Of Karl O.
Pinc
 Sent: Monday, June 08, 2009 6:35 PM
 To: Paolo Lucente; pmacct-discussion@pmacct.net
 Subject: Re: [pmacct-discussion] input/output interface informationin
 nfacctd?
 
 
 On 06/08/2009 06:00:46 PM, Paolo Lucente wrote:
  Hi Suraj,
  
  This information is not immediately available within the
  database or memory table; but you can match such fields
  within the Pre-Tagging infrastructure to generate a tag
  - which can, in turn, be either just used internally for
  filtering or splitting data among the plugins or can be
  made available to the backend via the 'tag' aggregation
  primitive.
 
 Good summary of what tagging is for.  Is there a place
 to drop it on the wiki?
 
  
  See 'examples/pretag.map.example' in the pmacct tarball;
  also pre_tag_map and pre_tag_filter in the CONFIG-KEYS
  document.
  
  Cheers,
  Paolo
  
  
  On Mon, Jun 08, 2009 at 06:07:56PM -0400, Suraj Nellikar (snellika)
  wrote:
   Hi,
  
   Doesn't the pmacct collector (I am running nfacctd) provide the
  Input
   Interface,Output Interface information which is present in the
  Netflow
   packets?
  
  
  
   Thanks,
  
   Suraj.N
  
  
  ___
  pmacct-discussion mailing list
  http://www.pmacct.net/#mailinglists
  
  
 
 
 Karl k...@meme.com
 Free Software:  You don't pay back, you pay forward.
   -- Robert A. Heinlein
 
 ___
 pmacct-discussion mailing list
 http://www.pmacct.net/#mailinglists

___
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists