Re: [pmacct-discussion] Error pmacct 1.7.2 Field 'class_id' doesn't have a default value
Hi Reginaldo, Can you please send the output of a 'pmacctd -V'? Are you looking for packet classification without linking against nDPI? If you are not looking for packet classification, you should remove 'class' from the aggregate; if you are looking for packet classification you should link against nDPI (see QUICKSTART document, look for 'nDPI'). In either case you should not get into this issue. Probably you are even given a warning in the logs, ie. "Class aggregation not possible due to missing --enable-ndpi". Paolo On Tue, Apr 23, 2019 at 02:45:02PM -0300, Reginaldo Lemos Macal wrote: > Hello, > > I have found the error bellow after execute the pmacctd -f > /etc/pmacct/pmacctd.conf command: > > ERROR ( default_mysql/mysql ): Field 'class_id' doesn't have a default value > > I'm using table V9, below is my pmacctd.conf file: > > root@srv-xflow:~# cat /etc/pmacct/pmacctd.conf > daemonize: true > pidfile: /var/run/pmacctd.pid > syslog: daemon > ! > interface: ens32 > ! > plugins: mysql > aggregate:tag,class,src_as,dst_as,vlan,src_host,dst_host,src_mac,dst_mac,src_port,dst_port,proto > sql_host: localhost > sql_user: root > sql_passwd: mypassword > sql_db: pmacct > sql_table_type: bgp > !sql_optimize_clauses: true > sql_table: acct_v9 > sql_table_version: 9 > networks_file: /etc/pmacct/hosts.networks > ! > ! refresh the db every minute > sql_refresh_time: 60 > ! reduce the size of the insert/update clause > sql_optimize_clauses: true > ! accumulate values in each row for up to an hour > sql_history: 5m > ! create new rows on the minute, hour, day boundaries > sql_history_roundoff: mhd > sql_cache_entries: 256000 > logfile: /var/log/pmacctd.log > > Has anyone seen this problem? or do you have any idea how to solve it? > Regards > ___ > pmacct-discussion mailing list > http://www.pmacct.net/#mailinglists ___ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
Re: [pmacct-discussion] IPFIX Periodic Template
Hi Rajesh, Since templates are sent out periodically (every 18th packet .. is a period :)), do you mean whether templates can be sent out on a time- based interval rather than a packet-based one? If so, currently this is not possible. The choice for each 18th packet was made originally in the softflowd code - probably a good small-enough number like anything else, i would not attach a magical sense to the number 18. The default can't be changed at the moment but exposing it via a config option would be trivial. Would a different packet-based interval work for you? My sense is that if the collector is multi-threaded and a template can land in one thread and data packets in a different one and templates are not distributed among the threads then the collector architecture is flawed (and engineering timeouts at the exporter is the wrong place to look at). But i speak without knowledge of the specific collector code, i'm just basing myself on your description. Your timeouts look good to me, i tend to recommend to set them short for better accuracy of stats - and you set them to 30 secs, which is short enough. Paolo On Tue, Apr 23, 2019 at 09:38:59PM +0530, RAJESH KUMAR S.R wrote: > Hi, > > I just need few clarifications,suggestions regarding IPFIX templates. > > 1. > Currently, just before sending the first flow packet, pmacctd seems to send > out the template packet and subsequently for every 18 packets. > We are facing the following issue: > we are using logstash(as part of ELK stack) as collector > (nfprobe_receiver), and it seems to run in multithreaded environment. > Since, the first template and flow packet is sent at the same time, they > are processed by different threads and flow packet is dropped as it doesn't > know the template. > Is there any configuration for sending template packets periodically. > 2. > Is there any particular reason for not sending template packets > periodically and sent for every 18th packet. > > 3. > Are the following timeouts a good choice for production environment. > nfprobe_timeouts: > general=30:maxlife=30:expint=30:udp=30:tcp=30:tcp.rst=30:tcp.fin=30:icmp=30 > > > > Thanks, > Rajesh kumar S R > ___ > pmacct-discussion mailing list > http://www.pmacct.net/#mailinglists ___ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists