Hey Edward,
each file contains the data of one timebin. Flows spread over a timeframe
longer than one timebin cause pmacct to create/update multiple files. Depending
on how long your Netflow exporter keeps the flow records before it flushes them
to the collector, the created/updated files
Hi Edward,
Mario is right.
Plus you can set nfacctd_time_new to true to make nfacctd use the time
of arrival at the collector (rather than individual flow start times)
for time binning. This approach will be less precise than using flow
start times; a few considerations at this propo: 1) if flow
In my environment setting nfacctd_time_new to true works better because
sometimes router/firewall clocks seems not synchronized. Routers and firewalls
are managed by another group of people so that I never chance to find out the
clock issue. Using collector's clock is much better in this
