Re: [pmacct-discussion] Error pmacct 1.7.2 Field 'class_id' doesn't have a default value

2019-04-24 Thread Paolo Lucente


Hi Reginaldo,

Can you please send the output of a 'pmacctd -V'? Are you looking for
packet classification without linking against nDPI? If you are not
looking for packet classification, you should remove 'class' from the
aggregate; if you are looking for packet classification you should link
against nDPI (see QUICKSTART document, look for 'nDPI'). In either case
you should not get into this issue. Probably you are even given a
warning in the logs, ie. "Class aggregation not possible due to missing
--enable-ndpi".

Paolo 

On Tue, Apr 23, 2019 at 02:45:02PM -0300, Reginaldo Lemos Macal wrote:
> Hello,
> 
> I have found the error bellow after execute the pmacctd -f
> /etc/pmacct/pmacctd.conf command:
> 
> ERROR ( default_mysql/mysql ): Field 'class_id' doesn't have a default value
> 
> I'm using table V9, below is my pmacctd.conf file:
> 
> root@srv-xflow:~# cat /etc/pmacct/pmacctd.conf
> daemonize: true
> pidfile: /var/run/pmacctd.pid
> syslog: daemon
> !
> interface: ens32
> !
> plugins: mysql
> aggregate:tag,class,src_as,dst_as,vlan,src_host,dst_host,src_mac,dst_mac,src_port,dst_port,proto
> sql_host: localhost
> sql_user: root
> sql_passwd: mypassword
> sql_db: pmacct
> sql_table_type: bgp
> !sql_optimize_clauses: true
> sql_table: acct_v9
> sql_table_version: 9
> networks_file: /etc/pmacct/hosts.networks
> !
> ! refresh the db every minute
> sql_refresh_time: 60
> ! reduce the size of the insert/update clause
> sql_optimize_clauses: true
> ! accumulate values in each row for up to an hour
> sql_history: 5m
> ! create new rows on the minute, hour, day boundaries
> sql_history_roundoff: mhd
> sql_cache_entries: 256000
> logfile: /var/log/pmacctd.log
> 
> Has anyone seen this problem? or do you have any idea how to solve it?
> Regards

> ___
> pmacct-discussion mailing list
> http://www.pmacct.net/#mailinglists


___
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists


Re: [pmacct-discussion] IPFIX Periodic Template

2019-04-24 Thread Paolo Lucente


Hi Rajesh,

Since templates are sent out periodically (every 18th packet .. is a
period :)), do you mean whether templates can be sent out on a time-
based interval rather than a packet-based one? If so, currently this is
not possible.

The choice for each 18th packet was made originally in the softflowd
code - probably a good small-enough number like anything else, i would
not attach a magical sense to the number 18. The default can't be
changed at the moment but exposing it via a config option would be
trivial. Would a different packet-based interval work for you?

My sense is that if the collector is multi-threaded and a template can
land in one thread and data packets in a different one and templates are
not distributed among the threads then the collector architecture is
flawed (and engineering timeouts at the exporter is the wrong place to
look at). But i speak without knowledge of the specific collector code,
i'm just basing myself on your description. 

Your timeouts look good to me, i tend to recommend to set them short for
better accuracy of stats - and you set them to 30 secs, which is short
enough. 

Paolo

 
On Tue, Apr 23, 2019 at 09:38:59PM +0530, RAJESH KUMAR S.R wrote:
> Hi,
> 
> I just need few clarifications,suggestions regarding IPFIX templates.
> 
> 1.
> Currently, just before sending the first flow packet, pmacctd seems to send
> out the template packet and subsequently for every 18 packets.
> We are facing the following issue:
> we are using logstash(as part of ELK stack) as collector
> (nfprobe_receiver), and it seems to run in multithreaded environment.
> Since, the first template and flow packet is sent at the same time, they
> are processed by different threads and flow packet is dropped as it doesn't
> know the template.
> Is there any configuration for sending template packets periodically.
> 2.
> Is there any particular reason for not sending template packets
> periodically and sent for every 18th packet.
> 
> 3.
> Are the following timeouts a good choice for production environment.
> nfprobe_timeouts:
> general=30:maxlife=30:expint=30:udp=30:tcp=30:tcp.rst=30:tcp.fin=30:icmp=30
> 
> 
> 
> Thanks,
> Rajesh kumar S R

> ___
> pmacct-discussion mailing list
> http://www.pmacct.net/#mailinglists


___
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists