Re: [pmacct-discussion] Expiring Orphan fragment

2010-05-04 Thread Sergio Charpinel Jr. 
Paolo,

Yes, it is working, thanks.

And I analyzed some flows related to expiring orphan, and most of them
seems to be related to torrents, but I'm not sure.

After some time (2hours+) running pmacctd and nfacctd, I start
receiving a lot of

WARN: expecting flow '817086981' but received '817086983'
collector=127.0.0.1:2100 agent=127.0.0.1:0
INFO: unable to read next Flowset; incomplete NetFlow v9 packet:
nfacctd=127.0.0.1:2100 agent=127.0.0.1:49586

in nfacctd log. I don't know with these 2 events are related. Do you
know if there is something wrong?

2010/5/3 Paolo Lucente pa...@pmacct.net:
 Hi Sergio,

 Good point.

 I've just marked PGRES_TUPLES_OK as valid return code within the
 PG_create_dyn_table() function - and committed the change to the
 CVS. Can you please confirm it works OK for you?

 Cheers,
 Paolo

 On Mon, May 03, 2010 at 10:10:18AM -0300, Sergio Charpinel Jr. wrote:
 Paolo,

 I think the problem is in the SELECT.
 SELECT returns PGRES_TUPLES_OK, which means, a PGRES_COMMAND_OK plus
 result data.

 [ ... ]





-- 
Sergio Roberto Charpinel Jr.

___
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists

Re: [pmacct-discussion] Expiring Orphan fragment

2010-05-04 Thread Paolo Lucente 
Hi,

To wrap-up this thread - unless new details emerge:
 
On Tue, May 04, 2010 at 11:53:59AM +, Paolo Lucente wrote:
 
 * one capturing some torrent traffic, so that i can replay it in a
   testbed and see if i can reproduce and validate the behaviour.

Orphan fragments are really there. Action point on my side is to mark
these log messages as debug rather than informational. 

 * the other capturing some NetFlow packets delivered to nfacctd so
   that i can look into them with a packet analyzer. It should never
   happen that nfacctd is unable to parse NetFlow datagrams produced
   by nfprobe.

The box was suffering sustained load due to the pmacctd process acting
as NetFlow probe lacking of internal buffering. This in turn generated
some packet loss. Adding the following lines to the configuration did
help bringing back the load of the box to acceptable levels:

plugin_buffer_size: 102400
plugin_pipe_size: 1024

Cheers,
Paolo


___
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists