Hi Alexandre,
Why don't you try to do a dump of routes received by pmacct? Like:
https://github.com/pmacct/pmacct/blob/1.7.4/QUICKSTART#L1780-#L1781
This test may require you compiling pmacct with JSON / Jansson support.
Also, for a test you could also add 'dst_host' on your 'aggregate'
config directive so you can see what comes into flows (that is, before
pmacct trying to perform the magics with network masking). With all of
this you should have a full view: what you get from BGP, what you get
from flows, what works and what does not work and perhaps establish a
pattern (if not already finding a cause, ie. a partial BGP view and
suchs).
Paolo
On Thu, Apr 16, 2020 at 05:17:55PM +0200, alexandre S. wrote:
> Hello,
>
> I am trying to log sflow data in a sqlite database, aggregated by
> destination AS and prefix.
>
> Currently I have configured the bgp_deamon plugin, along with the sqlite3
> one to run with sfacctd.
>
>
> The problem is that the data that almost all the traffic as an AS set to 0
> with a destination prefix set to 0.0.0.0/0. By looking at the database entry
> I found that a small part of the data is saved with the right values, and I
> can't find why.
>
> My guess was that the first hour had wrong values because of the time it
> took to receive all bgp information, so I let the daemon run for a few hours
> but it has happened each time the data was saved.
>
> The configuration file look like this :
>
>
>
> #daemonize: true
>
> #debug: true
> #debug_internal_msg: true
>
> bgp_daemon: true
> bgp_daemon_ip: 127.0.0.1
> bgp_daemon_port: 1180
> bgp_daemon_as:
> bgp_daemon_max_peers: 1
> bgp_table_dump_file:
> /pmacct-1.7.3/output/bgp-$peer_src_ip-%Y_%m_%dT%H_%M_%S.txt
> bgp_table_dump_refresh_time: 3600
> bgp_agent_map: /pmacct-1.7.3/etc/sfacctd_bgp.map
>
> plugins: sqlite3[simple]
>
> sql_db[simple]: /pmacct-1.7.3/output/pmacct.db
> sql_refresh_time[simple]: 3600
> sql_history[simple]: 60m
> sql_history_roundoff[simple]: h
> sql_table[simple]: acct
> sql_table_version[simple]: 9
>
> aggregate: dst_net, dst_mask, dst_as
>
> sfacctd_as: bgp
> sfacctd_net: bgp
> sfacctd_port: 2602
> sfacctd_ip:
> sfacctd_time_new: true
>
> --
>
> BGP agent map:
>
> bgp_ip=127.0.0.1 ip=
>
> --
>
> Regards, Alexandre
>
>
> ___
> pmacct-discussion mailing list
> http://www.pmacct.net/#mailinglists
___
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists
