Hi Gregoire, The template looks allright, it contains NAT event among the other things. From the template it would look like you are exporting from ASR1K, ASA or similar - it would be great if you could confirm (as i don't see TCP/UDP ports mentioned). Can you please try with a different aggregation method:
src_host,post_nat_src_host,nat_event,timestamp_start Let me know how it goes. It should work out of the box after, as you said, you receive the first template. If not, please send me privately a brief capture (including a template) of your NetFlow so that i can investigate the issue - happy to do that. Cheers, Paolo On Thu, Sep 05, 2013 at 01:33:10PM +0200, Grégoire Leroy wrote: > Hello, > > I've setup pmacct 0.14.3 in order to log CGN NEL Cisco data. I can > see traffic with pmacct but not with nfacct. It is not a firewall > issue, as a debug command shows me that packet are processed : > > (given that the length of the output, I've pastebined it) > http://bpaste.net/show/esBDqaWuYR0fbjsGgpoM/ > > (Note : contrary to what's written in the above output, at the end, > I don't have 3 times the same message, but 3 times the same kind of > messages i.e template). > > Without debug I juste have : > > # nfacctd -P print -r 10 -c src_host,dst_host > INFO ( default/core ): waiting for NetFlow data on 0.0.0.0:2100 > SRC_IP DST_IP PACKETS BYTES > > And nothing else. > > Did I miss something here ? if I understand correctly it's normal > that at first, before the transmission of template I have nothing, > but then ? Why doesn't this command print anything ? > > Thanks, > Regards, > Gregoire Leroy > > _______________________________________________ > pmacct-discussion mailing list > http://www.pmacct.net/#mailinglists _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
