Hi, i just set up pmacct and try to use nfacctd as netflow collector with a mysql backend for accounting purposes. The netflow v5 data is generated by a Cisco device with a sup720-3bxl card and several GigE interfaces and sent to a FreeBSD box running nfacctd. nfacctd is configured to store the data in a msysql datase on a remote server. After playing with some config options everything runs fine on the first tests with only one vlan-interface generating netflow data (a single customer with about 1000 mbits traffic on the vlan-interface). nfacctd receives the data, summarizes it according to the networks list and puts it into the mysql database every minute. The daily value for this customer looks like this when selected every minute from the database: 2051 GB, 2058 GB, 2069 GB, 2074 GB, 2079 GB, 2085 GB, 2091 GB This values are coherent for the traffic load on the interface.
So i started configuring other interfaces to generate netflow data on the Cisco device (about 1800mbits traffic). After this, the system logs only about 1GB every minute for the same customer: 2106 GB, 2107 GB, 2108 GB, 2109 GB, 2110 GB, 2112 GB, 2113 GB (I'd say that there is some lack of traffic ;-) ) Now i'm trying to figure out where the data gets lost. The load on the nfacct-box and the database servers is little (not more that 0.3 at all time). I ran nfacctd in debug mode, but i did not find any messages giving me a hint. Also on the cisco box everything looks fine, no high cpu or memory load. For the records, a snippet of my nfacctd-config: daemonize: true #debug: true networks_file: /root/conf/agtv-nets.list aggregate: src_host,dst_host nfacctd_port: 9787 plugins: mysql sql_optimize_clauses: true sql_table_schema: /root/conf/dbs-dat.schema sql_refresh_time: 60 sql_history: 1d sql_history_roundoff: d sql_db: accounting sql_table: tkue_%Y_%m_%d sql_host: X sql_passwd: Y sql_user: Z Also the netflow-config on the cisco box: ip flow-cache entries 520000 ip flow-cache timeout active 1 mls netflow interface mls flow ip interface-full mls nde sender version 5 ip flow-export version 5 ip flow-export destination 172.16.80.10 Maybe somebody on the list can give me a hint if there are any options to optimize or if there is any bottleneck i did not think about - any help is appreciated. Thanks, Chris _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
