Re: [pmacct-discussion] New to pmacct - Need help with Netflow

2017-01-18 Thread Yann Belin
Hi Luc, Did you try to enable debug mode on nfacctd (-d)? It will show you when the flows are received, as well any potential errors when sending it to db. Also, keep in mind that if you use NetflowV9/IPfix, nfacctd wont be able to process incoming flows until a template is received. Cheers,

Re: [pmacct-discussion] nfacctd and NBAR

2016-12-14 Thread Yann Belin
work (in > CONFIG-KEYS which, in turn, points you to an example). > > Cheers, > Paolo > > On Mon, Dec 12, 2016 at 01:38:29PM +0100, Yann Belin wrote: >> Hello, >> >> I am trying to use the NBAR "application ID" field (#95) in nfacctd >> aggrega

Re: [pmacct-discussion] Configure with MySQL / MariaDB support

2016-12-13 Thread Yann Belin
you check soft links, whether it's pointing to proper .so file ? > > > -Original Message- > From: pmacct-discussion [mailto:pmacct-discussion-boun...@pmacct.net] On > Behalf Of Yann Belin > Sent: Tuesday, December 13, 2016 3:07 PM > To: pmacct-discussion@pmacct.net > Subject: Re:

[pmacct-discussion] Configure with MySQL / MariaDB support

2016-12-13 Thread Yann Belin
Hello, I am trying to install pmacct with MySQL / MariaDB support but [./configure --enable-mysql] fails with the message below. *-*-*-*-* (...) checking for mysql_init in -lmysqlclient... no configure: error: ERROR: missing MySQL client library *-*-*-*-* I have proper libraries and devel

Re: [pmacct-discussion] Configure with MySQL / MariaDB support

2016-12-13 Thread Yann Belin
1 exit status Kind regards, Yann On Tue, Dec 13, 2016 at 11:01 AM Yann Belin <y.belin...@gmail.com> wrote: > Hi Mehul, > > Yes I thought it could be the issue too but the softlinks look fine on FS > level. > > [root@ pmacct]# ll /usr/lib64/libmysqlclient.* > -rw-r-

Re: [pmacct-discussion] Configure with MySQL / MariaDB support

2016-12-13 Thread Yann Belin
_LIBRARY_PATH=$LD_LIBRARY_PATH: /usr/lib64/ > > -Original Message- > From: pmacct-discussion [mailto:pmacct-discussion-boun...@pmacct.net] On > Behalf Of Yann Belin > Sent: Tuesday, December 13, 2016 2:47 PM > To: pmacct-discussion@pmacct.net > Subject: [pmacct-discussio

[pmacct-discussion] Reporting on additional primitives

2016-12-15 Thread Yann Belin
Hello, I am looking for a way to report on additional primitives with nfacct. It does by default with bytes and packets but I cannot find how to add extra fields. Am I missing something? What I want to include in reports is application performance information (rtd, packet-loss, etc.) from Cisco

Re: [pmacct-discussion] Centralizing data from multiple nfacct collectors

2017-01-05 Thread Yann Belin
Thanks all! I spent a couple of hours trough RabbitMQ docs/specs and it seems to be exactly what I need. On Thu, Jan 5, 2017 at 3:15 PM Karl O. Pinc <k...@meme.com> wrote: On Thu, 5 Jan 2017 10:57:01 +0100 Yann Belin <y.belin...@gmail.com> wrote: > Not strictly a pmacct/nfacct

[pmacct-discussion] Centralizing data from multiple nfacct collectors

2017-01-05 Thread Yann Belin
Hello, Not strictly a pmacct/nfacct question, but I was wondering if anyone ever built a similar setup. I have multiple sites that need to gather netflow data. Because network constraints (mostly latency) it is not possible to write directly to a central location so the collectors have to store

Re: [pmacct-discussion] Reporting on additional primitives

2016-12-21 Thread Yann Belin
at i may > suggest as workaround is to use the aggregate_primitives framework you > have today and make the averages yourself by post-processing the output. > > Cheers, > Paolo > > On Thu, Dec 15, 2016 at 01:44:16PM +0100, Yann Belin wrote: > > Hello, > > > > I

Re: [pmacct-discussion] pretag_map with multiple option records

2016-12-22 Thread Yann Belin
ions_iface]: 200 aggregate[options_iface]: peer_src_ip, in_iface, iface_short, iface_long sql_table[options_iface]: pmacct_options_iface !(...) Cheers, Yann On Wed, Dec 21, 2016 at 4:54 PM Yann Belin <y.belin...@gmail.com> wrote: > Hello, > > Aft

[pmacct-discussion] pretag_map with multiple option records

2016-12-21 Thread Yann Belin
Hello, After following the examples in pmacct documentation, I was able to assign different tags to flow and option records (respectively 100 and 200) , but I cannot figure out how to assign different tags to different "types" of option records in order to store their data in different SQL

Re: [pmacct-discussion] Matching data to options with nfacctd

2017-06-07 Thread Yann Belin
D. So, given the current functionality, it sounds you are > doing the right thing saving both and correlating it afterwards as part > of your post-processing. It would be great to know - here or via unicast > email - what kind of correlation you are doing. > > Paolo > > > On Tue, Ju

[pmacct-discussion] Strange behavior with protocol field on nfacctd

2017-06-14 Thread Yann Belin
Hello, I am experiencing a strange behavior on nfacctd. * On version 1.6.1, flows with protocol field set to 6 (TCP) will not show up at all. * On version 1.6.2, flows with protocol field set to 6 (TCP) will show up, but ip_src and ip_dst will be empty. In both cases, flows with protocol field

[pmacct-discussion] Matching data to options with nfacctd

2017-06-06 Thread Yann Belin
Hi, I was reading trough recent issues on GitHub, and #137 [see link below] got my attention. The last comment from Paolo leads me to think that nfacctd can be configured to (try to) automatically match flow data to option table(s). Is it the case, or am I misreading something? Until now, I have

Re: [pmacct-discussion] nfacctd and amqp_multi_values

2017-09-19 Thread Yann Belin
ages (ie. > amount of messages you want to batch before sending to the broker) or > queue.buffering.max.ms (queue for some given amount of time, if for > example latency is the constraint) offered by librdkafka. > > Paolo > > On Thu, Sep 14, 2017 at 04:12:45PM +0200, Ya

[pmacct-discussion] nfacctd and amqp_multi_values

2017-09-14 Thread Yann Belin
Hello, Does anyone know if there is a way to control the maximum number of rows sent in an AMQP message? amqp_multi_values allows me to do that in an approximate way (row_size/message_size) but I need to have a finer control on that, which is not dependent of variations of row size. Thanks in

[pmacct-discussion] Load balancing nfacctd

2017-08-21 Thread Yann Belin
Hello, I have been looking into solutions to achieve reliable load balancing of my incoming flows across multiple nfacctd servers / daemons. Basic load balancing is relatively easy (see Nginx configuration below), but *reliable* load balancing (only sending flows to servers that have a running

[pmacct-discussion] Best way to output ip addresses as integers

2017-09-04 Thread Yann Belin
Hello, I need to run some checks / manipulate source/destination IP addresses that I am getting from nfacctd, and for that purpose it makes much more sense to output hose IPs in their inetger form, rather than in their human-readable (x.x.x.x) form. In order to do that, I created custom

Re: [pmacct-discussion] Load balancing nfacctd

2017-09-04 Thread Yann Belin
, if anyone has a suggestion. Cheers, Yann On Mon, Aug 21, 2017 at 4:02 PM, Aaron Finney <aaron.fin...@openx.com> wrote: > Hi Yann > > We use Consul for this, it works very well. > > https://www.consul.io > > > Aaron > > > > On Aug 21, 2017 6:44 AM,