Hi Jordan, Inline:
On Thu, Jul 28, 2016 at 12:01:47AM +0300, Jordan wrote: > I mean that when you enable sflow on an interface you cannot > configure ingress/egress option. > It captures both directions while we need only data for ingress traffic. Just curious, which device is this? Never seen such a behaviour and it looks wrong to me as it would lead to duplicates as soon as you enable sFlow on a second port. > There are two major problems with your solution. I think /direction > /is not a valid sfacct key and we already use pretagging(both > tag,tag2) for other purposes. I think you have three main options: 1) let your device export ingress- only or egress-only but not both; 2) filter duplicates/unwanted in pmacct: you can do that via pre_tag_map, as Mario was suggesting; you may set labels rather than tags since labels can be stacked, then you can filter on one of the labels in the stack; it may turn easier than doing math ops against numerical tags; 3) log all down to the backend and clean data yourself as part of your post-processing. Problem with #2 and #3 is how to identify ingress/egress samples as sFlow Flow Samples, afaik, do not carry information about direction (that is why pmacct can't help and the 'direction' keyword does not apply to sFlow). My feeling is, maybe also the most obvious solution, you want to solve this with #1. Cheers, Paolo _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
