No problem! If you feel like RTFM :), check out the official examples
http://wiki.pmacct.net/OfficialExamples under Section XVII - Using pmacct
as traffic/event logger; they have some initial information that can be
used. It took me a little trial and error to figure it out.
Robert Juric
On Tue,
A… aggregating on something which can’t be aggregated. Nice hack :-)
Thanks Robert
> On 19 Apr 2016, at 15:26, Robert Juric wrote:
>
> I found you have to build the tables with timestamps and then when you
> aggregate with timestamp_start and timestamp_end you can get the individual
> flow
I found you have to build the tables with timestamps and then when you
aggregate with timestamp_start and timestamp_end you can get the individual
flow records as opposed to aggregating the records.
Robert Juric
On Tue, Apr 19, 2016 at 9:00 AM, Dariush Marsh-Mossadeghi <
dari...@gravitas.co.uk>
Hi List,
Is there a way to get pmacctd/nfacctd to NOT do any aggregation of flow records
?
Specifically, I’ve got IPFIX coming off a router being handed by nfacctd and
it would be useful to temporarily have visibility of every flow record. Tcpdump
is not a suitable as part of what I’m trying
