My apologies, premature sending. Lets try again.
I have two questions: 1. How to cause nfacctd to reread it's config file without stopping & restarting the process ? I saw this post in the list a while ago: http://www.mail-archive.com/pmacct-discussion@pmacct.net/msg00293.html which seems to indicate that when daemonised the nfacctd process should respond to SIGHUP to reload it's config ? Is this correct ? If not, is there a way to get the running process to reload without having to do a stop & start. Once you kill the process any data that it has received but not yet written to DB will presumably be lost so that by killing it I might lose an hours worth of data (assuming sql_history: 1h). I have tried changing the sql_history parameter in the config file I am using and issued the kill signal to the parent process and the entries into the SQL DB don't reflect the change (I changed it from 5 mins, to 10 mins). If I kill the entire process and restart it, then it uses the new values. 2. Accuracy of stats ? There have been quite a few emails to the list on how accurate netflow stats are and there have been instances where people have been getting twice the numbers they should have and other where there was huge spikes. In the testing I have done I am getting a discrepancy of 6-7% of the bytes recorded. To further elaborate I am getting the stats via a mirrored port (Internet feed) that goes to a packeteer device. The packeteer records the data per IP address and it is also capable of exporting data as netflow records. I have configure the packeteer to export to my pmacct server and this is the data I am recording with pmacct. In theory the two should be the same as both sets of data come from the packeteer, one that it logs itself and one that it sends via netflow. The problem I have is that the netflow stats that I am collecting is LESS that the stats logged directly by the packeteer. The difference seems to vary, but for two different /29 netblocks measured over 5 days the differences were: Packeteer netblock1 = 4159489105 Netflow netblock1 = 3885265473 (93.4%) Packeteer netblock2 = 4255980963 Netflow netblock2 = 4177545774 (98.2%) As you can see the volume of data isn't that large and the only real thing the server is doing running these stats, so I don't think it's dropping packets or something like that. Can anyone suggest any reason why the netflow stats are different ? The ultimate goal is to remove the packeteer and replace it with netflow stats generated directly from a Cisco router, but I'm wary of doing this due to the discrepancies I am seeing. Mnay thanks, Tony. --- On Mon, 22/6/09, Tony <td_mi...@yahoo.com> wrote: > From: Tony <td_mi...@yahoo.com> > Subject: [pmacct-discussion] reloading config & accuracy > To: pmacct-discussion@pmacct.net > Date: Monday, 22 June, 2009, 1:47 PM > > Hi all, > > I have two questions: > > 1. How to cause nfacctd to reread it's config file without > stopping & restarting the process ? > > I saw this post in the list a while ago: > http://www.mail-archive.com/pmacct-discussion@pmacct.net/msg00293.html > > which seems to indicate that the > > > > > > _______________________________________________ > pmacct-discussion mailing list > http://www.pmacct.net/#mailinglists > _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
