Re: [pmacct-discussion] Getting nfacctd to NOT aggregate ?

[Robert Juric]

No problem! If you feel like RTFM :), check out the official examples
http://wiki.pmacct.net/OfficialExamples under Section XVII - Using pmacct
as traffic/event logger; they have some initial information that can be
used. It took me a little trial and error to figure it out.

Robert Juric

On Tue, Apr 19, 2016 at 9:49 AM, Dariush Marsh-Mossadeghi <
dari...@gravitas.co.uk> wrote:

> A… aggregating on something which can’t be aggregated. Nice hack :-)
> Thanks Robert
>
> On 19 Apr 2016, at 15:26, Robert Juric  wrote:
>
> I found you have to build the tables with timestamps and then when you
> aggregate with timestamp_start and timestamp_end you can get the individual
> flow records as opposed to aggregating the records.
>
> Robert Juric
>
>
>
> On Tue, Apr 19, 2016 at 9:00 AM, Dariush Marsh-Mossadeghi <
> dari...@gravitas.co.uk> wrote:
>
>> Hi List,
>>
>> Is there a way to get pmacctd/nfacctd to NOT do any aggregation of flow
>> records ?
>>
>> Specifically,  I’ve got IPFIX coming off a router being handed by nfacctd
>> and it would be useful to temporarily have visibility of every flow record.
>> Tcpdump is not a suitable as part of what I’m trying to ascertain is
>> whether the IPFIX data is accurate.
>>
>> Any suggestions/recipes/config snippets/pointers to RTFM would be
>> gratefully received.
>>
>> Thanks
>> Dariush
>>
>
>
> ___
> pmacct-discussion mailing list
> http://www.pmacct.net/#mailinglists
>
___
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists

Re: [pmacct-discussion] Getting nfacctd to NOT aggregate ?

[Dariush Marsh-Mossadeghi]

A… aggregating on something which can’t be aggregated. Nice hack :-)
Thanks Robert

> On 19 Apr 2016, at 15:26, Robert Juric  wrote:
> 
> I found you have to build the tables with timestamps and then when you 
> aggregate with timestamp_start and timestamp_end you can get the individual 
> flow records as opposed to aggregating the records.
> 
> Robert Juric
> 
> 
> 
> On Tue, Apr 19, 2016 at 9:00 AM, Dariush Marsh-Mossadeghi 
> > wrote:
> Hi List,
> 
> Is there a way to get pmacctd/nfacctd to NOT do any aggregation of flow 
> records ?
> 
> Specifically,  I’ve got IPFIX coming off a router being handed by nfacctd and 
> it would be useful to temporarily have visibility of every flow record. 
> Tcpdump is not a suitable as part of what I’m trying to ascertain is whether 
> the IPFIX data is accurate.
> 
> Any suggestions/recipes/config snippets/pointers to RTFM would be gratefully 
> received.
> 
> Thanks
> Dariush



signature.asc
Description: Message signed with OpenPGP using GPGMail
___
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists