On Sun, Apr 28, 2013 at 3:53 PM, Paolo Lucente <pa...@pmacct.net> wrote:
> Hi George-Cristian, > > You do not specify what is input of network traffic - netflow, sflow or > packet capture. Since you speak of one minute temporal aggregation being > too coarse-grained, i believe your input is netflow. Is then your purpose > to log down micro-flows to the database, ie. ideally disable any sort of > time aggregation? That's not entirely true. While having flows in the DB won't hurt, our idea was to just aggregate over small time intervals (say 15 seconds) so we can then look in more detail at some traffic patterns. Granted, we can probably aggregate with the DB's help, so that'd probably work too. > If this is all correct you can get latest code from the > CVS where you have availability of newly introduced timestamp_start and > timestamp_end primitives precisely for this purpose. > I will, thanks! > Your question could be why introducing such basic time-related primitives > so recently. Q6 in the new FAQS document addresses this point: "pmacct was > not originally meant to log network traffic at packet/micro-flow level: it > allows to get an aggregated view of the traffic -- both in space and in > time. On top of that, there are layers of filtering, sampling and tagging. > These are the keys to scale. As these features are fully configurable, data > granularity and resolution can be traded off in favour of increased > scalability > or less resources consumption. More recently, logging has been introduced, > by means of two new primitives timestamp_start and timestamp_end, fostered > by the development of NetFlow/IPFIX as generic transport protocol, ie. as > a replacement of syslog; it was then intuitive to generalize the logging > support to the more traditional traffic accounting part." > > My question is more like "any particularly convincing reason why there's a 1m limit (which to me looks quite arbitrary and useless) for dumping things into SQL". > Hope the above helps, let me know. > It probably will, and while I won't really look into it until Monday, I will let you know! -- George-Cristian Bîrzan
_______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
