Re: [pmacct-discussion] pmacct performance

Hi Anthony, What version are you using? You can confirm this with a nfacctd -V. Also, please post your integral config. I use kafka_history myself in production so i lean towards: either you are running some code from master that unluckily is not working or some combination of directives of your

Re: [pmacct-discussion] pmacct performance

Yep so it looks like everytime kafka_history runs no matter what interval you put it on it will crash pmacct and restart the service. On Sat, Nov 18, 2017 at 9:27 AM, Anthony Caiafa <2600...@gmail.com> wrote: > Sounds good. I’ll be sending out some data to you. > > On Sat, Nov 18, 2017 at 9:25 AM

Re: [pmacct-discussion] pmacct performance

Sounds good. I’ll be sending out some data to you. On Sat, Nov 18, 2017 at 9:25 AM Paolo Lucente wrote: > > Hi Anthony, > > Keep me posted on the ordering part. Wrt the complete drop in the > service, as you described in your original email, i have little info to > comment:

Re: [pmacct-discussion] pmacct performance

Hi Anthony, Keep me posted on the ordering part. Wrt the complete drop in the service, as you described in your original email, i have little info to comment: let's say it should never happen but i don't know to this point if it's a crash or a graceful shutdown with some message in the logs. If

Re: [pmacct-discussion] pmacct performance

Hi Anthony, I map the word 'message' to 'flow' and not to NetFlow packet, please correct me if this assumption is wrong. 55m flows/min makes it roughly 1m flows/sec. I would not recommend stretching a single nfacctd daemon beyond beyond 200K flows/sec and the beauty of NetFlow, being UDP, is

[pmacct-discussion] pmacct performance

Hi! So my usecase may be slightly larger than most. I am processing 1:1 netflow data for a larger infrastructure. We are receiving about 55million messages a minute which isn’t much but through pmacct it seems to not like it so much. I have pmacct scheduled with nomad running across a few machines

Re: [pmacct-discussion] pmacct performance

...@pmacct.net To: pmacct-discussion@pmacct.net Subject: Re: [pmacct-discussion] pmacct performance Hi Stathis, Two questions on your current setup: 1) are you already using pmacct against a PF_RING-enabled libpcap? You made reference to this in your email; 2) Can you determine what makes CPU

Re: [pmacct-discussion] pmacct performance

: pmacct-discussion@pmacct.net Subject: Re: [pmacct-discussion] pmacct performance Hi Stathis, Since you use PF_RING, you can review an advice i gave to Joan a couple months back when he was asking how to scale up a pmacctd deployment; see specifically the replication idea i gave

Re: [pmacct-discussion] pmacct performance

06.04.2014 20:17, Stathis Gkotsis пишет: Hi all, I am using pmacctd with libpcap. Will add my 5cent. Use libpcap with high load system not good idea. You will lost more then 50% traffic. IMHO better idea use http://sourceforge.net/projects/ipt-netflow/ for create netflow and then use nfacct

Re: [pmacct-discussion] pmacct performance

Hi Stathis, Two questions on your current setup: 1) are you already using pmacct against a PF_RING-enabled libpcap? You made reference to this in your email; 2) Can you determine what makes CPU go to 100%? Is it traffic rate or classification? Deterimining this is key to steer further

Re: [pmacct-discussion] pmacct performance

in the packet payload, basically searches for a hostname in the packet payload (I am interested in HTTP traffic). Thanks,Stathis Date: Mon, 7 Apr 2014 18:48:55 + From: pa...@pmacct.net To: pmacct-discussion@pmacct.net Subject: Re: [pmacct-discussion] pmacct performance Hi Stathis, Two

[pmacct-discussion] pmacct performance

Hi all, I am using pmacctd with libpcap. My configuration is the following: daemonize: falsepcap_filter: port 80 // only interested in HTTP trafficplugin_pipe_size: 10240plugin_buffer_size: 102400aggregate: src_host,dst_host,src_port,dst_port,proto,classclassifiers: