Hi Alexandre,
Why don't you try to do a dump of routes received by pmacct? Like: https://github.com/pmacct/pmacct/blob/1.7.4/QUICKSTART#L1780-#L1781 This test may require you compiling pmacct with JSON / Jansson support. Also, for a test you could also add 'dst_host' on your 'aggregate' config directive so you can see what comes into flows (that is, before pmacct trying to perform the magics with network masking). With all of this you should have a full view: what you get from BGP, what you get from flows, what works and what does not work and perhaps establish a pattern (if not already finding a cause, ie. a partial BGP view and suchs). Paolo On Thu, Apr 16, 2020 at 05:17:55PM +0200, alexandre S. wrote: > Hello, > > I am trying to log sflow data in a sqlite database, aggregated by > destination AS and prefix. > > Currently I have configured the bgp_deamon plugin, along with the sqlite3 > one to run with sfacctd. > > > The problem is that the data that almost all the traffic as an AS set to 0 > with a destination prefix set to 0.0.0.0/0. By looking at the database entry > I found that a small part of the data is saved with the right values, and I > can't find why. > > My guess was that the first hour had wrong values because of the time it > took to receive all bgp information, so I let the daemon run for a few hours > but it has happened each time the data was saved. > > The configuration file look like this : > > -------------------------------- > > #daemonize: true > > #debug: true > #debug_internal_msg: true > > bgp_daemon: true > bgp_daemon_ip: 127.0.0.1 > bgp_daemon_port: 1180 > bgp_daemon_as: <local as> > bgp_daemon_max_peers: 1 > bgp_table_dump_file: > /pmacct-1.7.3/output/bgp-$peer_src_ip-%Y_%m_%dT%H_%M_%S.txt > bgp_table_dump_refresh_time: 3600 > bgp_agent_map: /pmacct-1.7.3/etc/sfacctd_bgp.map > > plugins: sqlite3[simple] > > sql_db[simple]: /pmacct-1.7.3/output/pmacct.db > sql_refresh_time[simple]: 3600 > sql_history[simple]: 60m > sql_history_roundoff[simple]: h > sql_table[simple]: acct > sql_table_version[simple]: 9 > > aggregate: dst_net, dst_mask, dst_as > > sfacctd_as: bgp > sfacctd_net: bgp > sfacctd_port: 2602 > sfacctd_ip: <local ip> > sfacctd_time_new: true > > ------------------------------ > > BGP agent map: > > bgp_ip=127.0.0.1 ip=<sflow agent> > > ------------------------------ > > Regards, Alexandre > > > _______________________________________________ > pmacct-discussion mailing list > http://www.pmacct.net/#mailinglists _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
