On 21/10/14 02:37, Paolo Lucente wrote:
Do i then understand you are still unable to compile 1.5.0 on this
system, no matter which work around you are trying out? If yes, would
it be a possibility to get access to this box for first hand kind of
troubleshooting?
If I remove the --disable-so
On 23/10/14 14:40, itria30...@itri.org.tw wrote:
I guess the issue happened during static build. It seems be a common
problem of libpcap. I experienced this issue in other project using libpcap.
Well the question still remains why it worked with 1.5.0rc1 but not
1.5.0 full.
--
for the rc1.
I'm not sure what to try next - any suggestions?
Thanks,
Chris.
___
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists
.
Cheers, Chris.
--
Aptivate | http://www.aptivate.org | Phone: +44 1223 967 838
Citylife House, Sturton Street, Cambridge, CB1 2QF, UK
Aptivate is a not-for-profit company registered in England and Wales
with company number 04980791.
___
pmacct
: pmacct
sql_passwd: X
sql_refresh_time: 60
sql_dont_try_update: true
sql_optimize_clauses: true
sql_preprocess: minb = 1
From page 47 of:
http://www.ws.afnog.org/afnog2013/tutorials/bmo/afnog-bmo-presentation.odp
Cheers, Chris.
--
Aptivate | http://www.aptivate.org | Phone: +44 1223
.
Cheers, Chris.
--
Aptivate | http://www.aptivate.org | Phone: +44 1223 967 838
Citylife House, Sturton Street, Cambridge, CB1 2QF, UK
Aptivate is a not-for-profit company registered in England and Wales
with company number 04980791.
___
pmacct
the source and destination host and
port at all, let alone store it in a SQL database (no sample output is
provided), and presumably it does nothing with https.
Cheers, Chris.
--
Aptivate | http://www.aptivate.org | Phone: +44 1223 967 838
Citylife House, Sturton Street, Cambridge, CB1 2QF, UK
the inserts into multiple batches, otherwise a smaller batch size would
work too. So one day you might have more than 1000 flows to insert at a
time, and you'd get this error and lose data. In fact are you sure you
haven't lost any data already?
Cheers, Chris.
--
Aptivate | http://www.aptivate.org
[17603]: ERROR (
summary/mysql ): 'sql_multi_values' is too small (100). Try with a
larger value.
Cheers, Chris.
--
Aptivate | http://www.aptivate.org | Phone: +44 1223 967 838
Citylife House, Sturton Street, Cambridge, CB1 2QF, UK
Aptivate is a not-for-profit company registered in England
seem to be a minor bug in that pmacct appears to fall over if
the value is too small. I'm sure it could log a warning and write larger
but valid INSERT statements, with at least one VALUES row per statement.
Cheers, Chris.
--
Aptivate | http://www.aptivate.org | Phone: +44 1223 967 838
Citylife
), FROM_UNIXTIME(1378141080), '00:1b:21:92:98:17'
at line 1
This looks like a bug to me? Surely it should be reasonable to insert
up to 100 rows at a time (per SQL statement) instead of just 1?
Cheers, Chris.
--
Aptivate | http://www.aptivate.org | Phone: +44 1223 967 838
Citylife House, Sturton Street
Hi Paolo,
On Tue, 25 Jun 2013, Paolo Lucente wrote:
Sure, thanks for the tip: makes sense, will do.
Also please find attached an RPM spec file to help build rpms for pmacct.
It would be great if you could include this in the tarball.
Cheers, Chris.
--
Aptivate | http://www.aptivate.org
Hi Paolo,
Configure fails to find /usr/lib64/mysql/libmysqlclient.so on 64-bit
CentOS. You might want to add that to the list of search directories in
configure.in?
Cheers, Chris.
--
Aptivate | http://www.aptivate.org | Phone: +44 1223 967 838
Citylife House, Sturton Street, Cambridge, CB1
Hi Paolo,
On Fri, 29 Jun 2012, Paolo Lucente wrote:
On Tue, Jun 26, 2012 at 10:13:30AM +0100, Chris Wilson wrote:
OK, testing now. Would it be possible for pmacctd to log a warning if
it exceeds any of these thresholds, to help with tuning without wasting
memory?
In a way you reckon things
in the same stream and see how much traffic
is being wrongly classified?
Cheers, Chris.
--
Aptivate | http://www.aptivate.org | Phone: +44 1223 967 838
Future Business, Cam City FC, Milton Rd, Cambridge, CB4 1UY, UK
Aptivate is a not-for-profit company registered in England and Wales
with company number
.
Is it possible that it either failed to remove some records from the
cache, or calculated the timestamp of the database records incorrectly?
Cheers, Chris.
--
Aptivate | http://www.aptivate.org | Phone: +44 1223 967 838
Future Business, Cam City FC, Milton Rd, Cambridge, CB4 1UY, UK
Aptivate
,
'plugin_buffer_size'; now: '192'.
Jun 10 05:13:01 fen-fw2 pmacctd[4070]: - increase system maximum socket
size.
How would I know which parameter to increase? Could the writer tell us
exactly which limit it hit?
Cheers, Chris.
--
Aptivate | http://www.aptivate.org | Phone: +44 1223 967 838
Future
Hi Johan, your nfacctd is compiled without mysql support, so it's not logging
to the database, only the memory plugin. Please fix that and try again. Cheers,
Chris.
-Original Message-
From: johan lotter jlct...@gmail.com
Sender: Chris Wilson ch...@aptivate.orgDate: Sun, 1 Apr 2012 16
replying to.
Cheers, Chris.
--
Aptivate | http://www.aptivate.org | Phone: +44 1223 967838
The Humanitarian Centre, Fenner's, Gresham Road, Cambridge CB1 2ES
Aptivate is a not-for-profit company registered in England and Wales
with company number 04980791
would make it much easier to
work on and extend pmacct.
Cheers, Chris.
--
Aptivate | http://www.aptivate.org | Phone: +44 1223 760887
The Humanitarian Centre, Fenner's, Gresham Road, Cambridge CB1 2ES
Aptivate is a not-for-profit company registered in England and Wales
with company number
or dst net
88.215.192.0/19))
These filters look identical to me. How come it both works and doesn't
work?
Cheers, Chris.
___
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists
does.
Cheers, Chris.
___
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists
running? Or might you have changed the config without
restarting it?
Cheers, Chris.
--
Aptivate | http://www.aptivate.org | Phone: +44 1223 760887
The Humanitarian Centre, Fenner's, Gresham Road, Cambridge CB1 2ES
Aptivate is a not-for-profit company registered in England and Wales
with company
config.sql_table_version 8 instead.
By the way I've written this story up in a blog post, I hope that's OK,
but please let me know if you want me to edit it:
http://blog.aptivate.org/2010/10/06/consistency-portability-and-backwards-compatibility/
Cheers, Chris
agreed to simply He agreed - i'm not such of an un-cooperative beast,
am i?
Of course not, far from it :) I've changed it.
Cheers, Chris.
___
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists
Hi Paolo,
On Wed, 15 Sep 2010, Paolo Lucente wrote:
On Tue, Sep 14, 2010 at 09:16:37AM +0200, Chris Wilson wrote:
I'm not sure about adding a new config switch, do we actually need it?
Funnily enough, and that was my perspective, in this case a configuration
switch only adds two
where
possible, as it exponentially multiplies the complexity of the software
code and also linearly increases the complexity of using it.
If our intention is to rename the MySQL fields going forward, why not just
use a new schema version to grandfather the old column names?
Cheers, Chris
of the mysql or postgres
schema?
Cheers, Chris.
--
Aptivate | http://www.aptivate.org | Phone: +44 1223 760887
The Humanitarian Centre, Fenner's, Gresham Road, Cambridge CB1 2ES
Aptivate is a not-for-profit company registered in England and Wales
with company number 04980791
Hi Paolo,
For what it's worth the log seems to be aggregated on the history time.
I only see the 5 min increments when I run pmpgplay in debug mode.
Yes, this is because you get logged down the exact tuple that was going
to be written to the database. And records in the database are fitted in
Hi,
The 'failsafe' mechanism (ie. writing to a backup database or to log
files) kicks in upon receipt of an error code from the RDBMS API. So
what you see in the log file should never be already in the database.
Excellent, thanks.
Your specific configuration is tricky because you write to
Hi,
I'm using pmacct-0.12.0rc3 with postgresql.
I've been trying to work out what pmpgplay does when it looks at a log
file. I couldn't find much in my searches that go into the details of
how it does things.
It seems it generates a bunch of sql, but does it check to see if that
record
.
Thanks for your help with this :)
Cheers, Chris.
--
Aptivate | http://www.aptivate.org | Phone: +44 1223 760887
The Humanitarian Centre, Fenner's, Gresham Road, Cambridge CB1 2ES
Aptivate is a not-for-profit company registered in England and Wales
with company number 04980791
Hi Karl,
On Fri, 19 Feb 2010, Karl O. Pinc wrote:
On 02/19/2010 07:42:08 AM, Chris Wilson wrote:
I deleted the primary key from that table because it should not be
necessary (there should not be any duplicates if everything is
configured correctly) and it makes inserts extremely slow
is necessary in order to have their source IP natted.
Cheers, Chris.
--
Aptivate | http://www.aptivate.org | Phone: +44 1223 760887
The Humanitarian Centre, Fenner's, Gresham Road, Cambridge CB1 2ES
Aptivate is a not-for-profit company registered in England and Wales
with company number 04980791
.
Is any real-world system set to UTC? I'm certainly not going to run my
firewall (where I run pmacct currently) on UTC. All my logs would be
screwed up and much harder to interpret.
Cheers, Chris.
--
Aptivate | http://www.aptivate.org | Phone: +44 1223 760887
The Humanitarian Centre, Fenner's
or
neither.
How else could we do it with what we already have? We could write to
different tables at different levels of aggregation, and let the user
choose which one to use, and delete old data from each table to stop it
becoming too large... but that gets more complicated for the user.
Cheers, Chris
to the database, never rejected, so
SUM(bytes) would again equal the interface counters for any given time
range.
Cheers, Chris.
--
Aptivate | http://www.aptivate.org | Phone: +44 1223 760887
The Humanitarian Centre, Fenner's, Gresham Road, Cambridge CB1 2ES
Aptivate is a not-for-profit company
, and merge them all together in our code. However I can see
that some people would prefer to keep them in separate tables.
Cheers, Chris.
--
Aptivate | http://www.aptivate.org | Phone: +44 1223 760887
The Humanitarian Centre, Fenner's, Gresham Road, Cambridge CB1 2ES
Aptivate is a not-for-profit
this flexible aggregation
in pmacct? Could the code be taken from Aguri under BSD license?
Cheers, Chris.
--
Aptivate | http://www.aptivate.org | Phone: +44 1223 760887
The Humanitarian Centre, Fenner's, Gresham Road, Cambridge CB1 2ES
Aptivate is a not-for-profit company registered in England
, i.e. working in local time or DST, makes
working across time zones difficult, and computing intervals (in the
case of DST) impossible.
I agree with Karl. Timestamps in UTC in the database make the most sense
for me.
Cheers, Chris.
--
Aptivate | http://www.aptivate.org | Phone: +44 1223 760887
. pthread_getspecific() should not crash,
that makes me think that the heap has been trashed (stack looks generally
OK as the backtrace is OK). Perhaps a Valgrind is in order? Any static
or fixed-size buffers in the mysql plugin that might be busted?
Cheers, Chris.
--
Aptivate | http
a thread other than the
first one and switch to it with thread xxx and continue, and hope
that that thread dies with SIGSEGV.
Is pmacctd not terminated once pressing ctrl+c?
It shouldn't be, gdb should intercept the SIGINT and stop it from reaching
the process.
Cheers, Chris.
--
Aptivate
' for key 1
Apr 13 17:20:01 server1 kernel: pmacctd[12419]: segfault at 3827208c ip
f7c599ca sp ffde7894 error 4 in
libpthread-2.3.6.so[f7c51000+e000]
As this crash is so early, perhaps the thread isn't initialised properly?
Cheers, Chris.
--
Aptivate | http://www.aptivate.org | Phone
stamp_inserted = 1:00 not 0:00, as far as I
know.
Cheers, Chris.
--
Aptivate | http://www.aptivate.org | Phone: +44 1223 760887
The Humanitarian Centre, Fenner's, Gresham Road, Cambridge CB1 2ES
Aptivate is a not-for-profit company registered in England and Wales
with company number 04980791
have any ideas what might be going on here?
Cheers, Chris.
--
Aptivate | http://www.aptivate.org | Phone: +44 1223 760887
The Humanitarian Centre, Fenner's, Gresham Road, Cambridge CB1 2ES
Aptivate is a not-for-profit company registered in England and Wales
with company number 04980791
or
external).
Cheers, Chris.
--
Aptivate | http://www.aptivate.org | Phone: +44 1223 760887
The Humanitarian Centre, Fenner's, Gresham Road, Cambridge CB1 2ES
Aptivate is a not-for-profit company registered in England and Wales
with company number 04980791
in the pcap file while reading it?
Cheers, Chris.
--
Aptivate | http://www.aptivate.org | Phone: +44 1223 760887
The Humanitarian Centre, Fenner's, Gresham Road, Cambridge CB1 2ES
Aptivate is a not-for-profit company registered in England and Wales
with company number 04980791
.
Cheers, Chris.
--
Aptivate | http://www.aptivate.org | Phone: +44 1223 760887
The Humanitarian Centre, Fenner's, Gresham Road, Cambridge CB1 2ES
Aptivate is a not-for-profit company registered in England and Wales
with company number 04980791
Hi Karl,
On Sat, 14 Mar 2009, Chris Wilson wrote:
sum_net gets you a all the traffic to and from each network you list in
your networks file, plus to and from anywhere else. The cross product.
In your case, if you put only 192.168.0.0/24 in your networks file you
get out totals
something
must have been wrong on the pmacct side. Running tcpdump in parallel
would be great for double-checking. And yes, pmacct honours timestamps
within pcap trace files.
OK, done. I assume the default snaplen of 96 bytes is OK for pmacct?
Cheers, Chris.
--
Aptivate | http
usage.
I would be very interested to see what you do in this space.
Cheers, Chris.
--
Aptivate | http://www.aptivate.org | Phone: +44 1223 760887
The Humanitarian Centre, Fenner's, Gresham Road, Cambridge CB1 2ES
Aptivate is a not-for-profit company registered in England and Wales
with company
as the interface name to capture all flows? I
think it should work, although it will not put any interface into
promiscuous mode. Please let us know if it does work.
Cheers, Chris.
--
Aptivate | http://www.aptivate.org | Phone: +44 1223 760887
The Humanitarian Centre, Fenner's, Gresham Road, Cambridge
for each instance.
tcpdump can bind to all interfaces but it can't put them all into
promiscuous mode at the same time. If that's OK for your application, try
using the device any instead of a real device.
Cheers, Chris.
___
pmacct-discussion mailing
it. Just add up the traffic for each source
address with a SQL SUM/GROUP BY and it will give you total traffic for all
hosts.
Cheers, Chris.
--
Aptivate | http://www.aptivate.org | Phone: +44 1223 760887
The Humanitarian Centre, Fenner's, Gresham Road, Cambridge CB1 2ES
Aptivate
by mistake?
Sorry, I think you're right, there were multiple instances running :(
Thanks again for your help.
Cheers, Chris.
--
Aptivate | http://www.aptivate.org | Phone: +44 1223 760887
The Humanitarian Centre, Fenner's, Gresham Road, Cambridge CB1 2ES
Aptivate is a not-for-profit company registered
.
Cheers, Chris.
--
Aptivate | http://www.aptivate.org | Phone: +44 1223 760887
The Humanitarian Centre, Fenner's, Gresham Road, Cambridge CB1 2ES
Aptivate is a not-for-profit company registered in England and Wales
with company number 04980791.
___
pmacct
aggregate_filter[out]: src net 192.168.0.0/16
Cheers, Chris.
--
Aptivate | http://www.aptivate.org | Phone: +44 1223 760887
The Humanitarian Centre, Fenner's, Gresham Road, Cambridge CB1 2ES
Aptivate is a not-for-profit company registered in England and Wales
with company number 04980791
(pattern) doesn't have
access to the bandwidth_db database.
Cheers, Chris.
--
Aptivate | http://www.aptivate.org | Phone: +44 1223 760887
The Humanitarian Centre, Fenner's, Gresham Road, Cambridge CB1 2ES
Aptivate is a not-for-profit company registered in England and Wales
with company number
that you can see the traffic
with tcpdump or wireshark before blaming pmacct :)
Cheers, Chris.
--
Aptivate | http://www.aptivate.org | Phone: +44 1223 760887
The Humanitarian Centre, Fenner's, Gresham Road, Cambridge CB1 2ES
Aptivate is a not-for-profit company registered in England and Wales
MB in this case.
The overhead will be much higher for smaller packets which may explain
your observed 30% discrepancy. If so, this is arguably a bug (or
limitation) of darkstat rather than pmacct.
Please let us know what you discover.
Cheers, Chris.
--
Aptivate | http://www.aptivate.org | Phone
the sflow
packets.
Running with '-d' shows that it is not processing any samples.
The samples are coming from Foundry switches.
Chris.
___
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists
); and your pmacct client software needs to be modified to take
advantage of the new table.
Cheers, Chris.
--
(aidworld) chris wilson | chief engineer ([EMAIL PROTECTED])
___
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists
on this
at LinuxTag 2005, which unfortunately is not available online in PDF form
(since LinuxTag apparently charges for access to conference papers). I
generated an HTML version and attached it here:
[http://bmo.aidworld.org/attach/Chris/paper.html]
Basically this means that the Linux kernel will be keeping
working on it.
Cheers, Chris.
--
(aidworld) chris wilson | chief engineer (http://www.aidworld.org)
___
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists
in total,
almost all database writers.
Is this really a good idea? Wouldn't it be better to serialise database
writes to some extent, to degrade gracefully rather than spiralling to
death? Or is this already possible and I missed the config option?
Thanks in advance for your help.
Cheers, Chris
you are purging the data to the database
long before history time has expired.
Chris
PS With that traffic load you will want sql_dont_try_update set to
true unless you have major league mysql server. Database row updates are
really expensive operations. I am collecting from a nearly fully
66 matches
Mail list logo
