Hi Rajesh,
Since templates are sent out periodically (every 18th packet .. is a
period :)), do you mean whether templates can be sent out on a time-
based interval rather than a packet-based one? If so, currently this is
not possible.
The choice for each 18th packet was made originally in the softflowd
code - probably a good small-enough number like anything else, i would
not attach a magical sense to the number 18. The default can't be
changed at the moment but exposing it via a config option would be
trivial. Would a different packet-based interval work for you?
My sense is that if the collector is multi-threaded and a template can
land in one thread and data packets in a different one and templates are
not distributed among the threads then the collector architecture is
flawed (and engineering timeouts at the exporter is the wrong place to
look at). But i speak without knowledge of the specific collector code,
i'm just basing myself on your description.
Your timeouts look good to me, i tend to recommend to set them short for
better accuracy of stats - and you set them to 30 secs, which is short
enough.
Paolo
On Tue, Apr 23, 2019 at 09:38:59PM +0530, RAJESH KUMAR S.R wrote:
> Hi,
>
> I just need few clarifications,suggestions regarding IPFIX templates.
>
> 1.
> Currently, just before sending the first flow packet, pmacctd seems to send
> out the template packet and subsequently for every 18 packets.
> We are facing the following issue:
> we are using logstash(as part of ELK stack) as collector
> (nfprobe_receiver), and it seems to run in multithreaded environment.
> Since, the first template and flow packet is sent at the same time, they
> are processed by different threads and flow packet is dropped as it doesn't
> know the template.
> Is there any configuration for sending template packets periodically.
> 2.
> Is there any particular reason for not sending template packets
> periodically and sent for every 18th packet.
>
> 3.
> Are the following timeouts a good choice for production environment.
> nfprobe_timeouts:
> general=30:maxlife=30:expint=30:udp=30:tcp=30:tcp.rst=30:tcp.fin=30:icmp=30
>
>
>
> Thanks,
> Rajesh kumar S R
> ___
> pmacct-discussion mailing list
> http://www.pmacct.net/#mailinglists
___
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists
