Hi Martin, Your config looks allright but unfortunately i can't try reproducing in lab due to two issues: 1) pmacct version you are using is rather old and 2) PF_RING. Your aggregation methods are very small so i can not think of a memory issue (especially because i grasp the address space to account for are a /21 and a /22). Given your traffic levels, are you in the position to use 0.12.5 without PF_RING for a test? Also, you might be using such setup for a while - can you recall any specific moment/change/etc when this behaviour started?
Cheers, Paolo On Mon, Jul 29, 2013 at 07:09:52AM +0000, Martin Hellström wrote: > Hi Paulo, > > We are using pmacct 12.5 with PF_RING. > > This is our configuration: > daemonize: true > syslog: daemon > debug: true > pidfile: /var/run/pmacctd.pid > plugins: mysql[in], mysql[out], mysql[vpn_in], mysql[vpn_out] > interface: eth1 > aggregate[in]: dst_host > aggregate[out]: src_host > aggregate[vpn_in]: src_host > aggregate[vpn_out]: dst_host > aggregate_filter[in]: dst net XX.XX.240.0/22 or dst net XX.XX.64.0/21 > aggregate_filter[out]: src net XX.XX.240.0/22 or src net XX.XX.64.0/21 > aggregate_filter[vpn_in]: dst host XX.XX.240.148 > aggregate_filter[vpn_out]: src host XX.XX.240.148 > sql_db: pmacct > sql_optimize_clauses: true > sql_table[in]: delta_in > sql_table[out]: delta_out > sql_table[vpn_in]: vpn_in > sql_table[vpn_out]: vpn_out > sql_refresh_time: 300 > sql_history: 5m > sql_history_roundoff: m > sql_dont_try_update: true > sql_preprocess[in]: minp=10 > plugin_pipe_size: 4096000 > plugin_buffer_size: 10240 > > Just removed some IPs. Other than that it's the config we use. > > Best, > Martin > > -----Original Message----- > From: pmacct-discussion [mailto:pmacct-discussion-boun...@pmacct.net] On > Behalf Of Paolo Lucente > Sent: den 27 juli 2013 11:45 > To: pmacct-discussion@pmacct.net > Subject: Re: [pmacct-discussion] Some IPs not logging outbound traffic > > Hi Martin, > > Can you specify which plugin and pmacct version are you using? Was wondering > if it could be a memory plugin which table fills up of entries, but you would > definitely see signs of this in the logs. > Maybe worth also posting your configuration. > > Cheers, > Paolo > > On Fri, Jul 26, 2013 at 12:14:44PM +0000, Martin Hellström wrote: > > Hi, > > > > We have a pmacct solution setup to monitor our incoming and outgoing > > traffic. However we've started to experience some problems recently with > > it. Some of the IPs have stopped logging the outgoing traffic for some > > reason. It's also limited to just a few addresses and they are always the > > same. Restarting Pmacct will make the logging work again for some time. > > It's also mostly the same couple of IPs that it stops working for. > > > > There is no real error output relating to this in the logs either. > > > > Best, > > Martin > > > > > > > _______________________________________________ > > pmacct-discussion mailing list > > http://www.pmacct.net/#mailinglists > > > _______________________________________________ > pmacct-discussion mailing list > http://www.pmacct.net/#mailinglists _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
