Hi all,
I use following primary key in both sfacctd and nfacctd sql table.
-PRIMARY
KEY(mac_src,mac_dst,ip_src,ip_dst,port_src,port_dst,ip_proto,timestamp_start,timestamp_start_residual
)
It works well on sfacctd’s sql table but failed on nfacctd with following
error message:
-INSERT INTO nf_a4 (mac_src, mac_dst, vlan, cos, etype, ip_src, ip_dst,
peer_ip_src, port_src, port_dst, tcp_flags, tos, ip_proto, country_ip_src,
country_ip_dst, timestamp_start, timestamp_start_residual, timestamp_end,
timestamp_end_residual, packets, bytes) VALUES ('00:00:00:00:00:00',
'00:00:00:00:00:00', 0, 0, '800', '140.96.29.26', '10.201.23.80',
'192.168.212.Sep 29 20:08:01 ERROR ( default/pgsql ): ERROR: duplicate key
value violates unique constraint "nf_a4_pkey"
My analysis shows:
1. The 2 netflow devices, 1 router and 1 firewall, output zero mac flows .
The mail-list said this might be due to the design of netflow agents.
2. The timestamp_start_residual is zero. In sfacctd’s case
timestamp_start_residual isn’t zero. This precious behavior makes
timestamp_start+ timestamp_start_residual a unique time series.
3. I don’t understand (1) and (2). Are they bugs or behaviors? If they
are behaviors, what columns I should use to create primary key?
Any comment is appreciated. Thanks in advance.
TC Wu
CCMA, ITRI, Taiwan
====================================================================
本信件可能包含工研院機密資訊,非指定之收件者,請勿使用或揭露本信件內容,並請銷毀此信件。
This email may contain confidential information. Please do not use or disclose
it in any way and delete it if you are not the intended recipient.
_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists