> -----Original Message----- > From: [EMAIL PROTECTED] [mailto:shorewall- > [EMAIL PROTECTED] On Behalf Of Simon Hobson > Sent: Monday, May 26, 2008 2:16 AM > To: [email protected] > Subject: Re: [Shorewall-users] IP Accounting values reset on "shorewall > restart" > > Tom Eastep wrote: > > >>I setup shorewall to do ip accounting for the > >>different IP's I run. > >> > >>I use cacti to graph those bandwidth usage stats per > >>IP. > >> > >>The problem I have is when I run: > >> > >># shorewall restart > >> > >>all the accounting stats go to zero and cause spikes > >>on the graphs on the next run which I then have to > >>kill/remove (I have a killspikes script to do this but > >>it's tedious). > >> > >>I think the spikes get graphed because cacti (or > >>really rrdtool) checks for the differences between the > >>previous kbps value and the next one it just got. > >> > >>Is there a way I can tell shorewall not to clear the > >>accounting stats when I do a restart? > > > >No -- your 'init' script needs to capture the counters before > >'restart' and your 'start' script needs to capture the values after > >and adjust your stats accordingly. > > For maximum accuracy : > > Before restarting Shorewall, force an update of the rrd - this gets > the last stats before the counters are cleared. Then perform another > update, but use 'U' for the values - this forces the rrd into a state > where the previous value was unknown and avoids any problems caused > by how to get from 'old' to 'new' values. > > Immediately after (re)start, perform another update with all zeros > for the values. This forces the baseline for future calculations to > be zero. > > Between them, these steps will capture all but a few packets between > getting the stats and resetting the firewall. >
Sorry to dig up such an old thread, but I'm faced with an identical problem. Are there any example scripts that people have written to help out with pointers on how to implement this? I'm not so concerned about accuracy in detecting missed traffic...more about not having the spikes. Thanks! ------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner_id=100&url=/ _______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
