Hi Mattias,
do you have a drawing of your setup? I have to admit that it is unclear to me…
Thanks,
Mario
From: pmacct-discussion [mailto:pmacct-discussion-boun...@pmacct.net] On Behalf
Of Mattias Larsson
Sent: Thursday, August 18, 2016 1:36 PM
To: pmacct-discussion@pmacct.net
Subject:
ussion-boun...@pmacct.net]
> On Behalf Of Stephen Clark
> Sent: Thursday, August 18, 2016 2:24 PM
> To: pmacct-discussion@pmacct.net
> Subject: Re: [pmacct-discussion] collecting large number of netflows
>
> On 08/17/2016 08:38 AM, Jentsch, Mario wrote:
> > Hey Steve,
> >
Hi Mehul
> Is there any configuration to start/stop accounting at run time ?
In Pmacct only by using maps + filtering and recreating + reloading the maps
for changes at runtime. For all I know - there is no API provided by Pmacct for
that and there is no way implemented to trigger actions
Hi Jordan,
not sure what you mean with “equipment that cannot separate inbound/outbound
traffic” but as long as you have direction in your flow data you can add a
pre-tag map like
!
! tag=1 - inbound IPv4 traffic
! tag=2 - outbound IPv4 traffic
! tag=3 - inbound IPv6 traffic
!
cket.
I like your suggestion of user groups.
How can I configure user groups in PMacct ?
Is there any provision such that this Accounting ON/OFF requests configuration
can be changes at run time ?
From: pmacct-discussion [mailto:pmacct-discussion-boun...@pmacct.net] On Behalf
Of Jentsch, Mario
when Accounting OFF is received.
Would you suggest any other suitable way?
From: pmacct-discussion [mailto:pmacct-discussion-boun...@pmacct.net] On Behalf
Of Jentsch, Mario
Sent: Tuesday, July 26, 2016 12:46 PM
To: pmacct-discussion@pmacct.net<mailto:pmacct-discussion@pmacct.net>
Subject: Re
Hi Mehul,
> Is there any mechanism available such that I can apply tagging and
> filtering at run time after decoding of RADIUS packet ?
Have a look at the "refresh_maps" config key. You can update your map at run
time and have pmacct reload it by sending SIGUSR2.
> After decoding, is there
> I just feel that running the server clock in UTC will be a bit
> uncomfortable having to constantly translate the dates from UTC to
> UTC+2/3 while working with logs etc.
Sounds like you don't have server in different time zones... believe me,
merging log data stored with local time from
Please note that for template based Netflow versions the destinations need them
to process data flowsets. Using the samplicator not all destinations get all
sent template flowsets - it will take some time and re-sending of these
template flowsets till all destinations received them and
Hi Pau,
it depends on the Netflow version. With versions that use templates it may be
the easiest way to ignore the data at the end points that is “too much”. The
problem is that without the templates the receiver can’t process the data.
For versions without templates have a look at the
Hi Vaggelis,
do the SNMP OIDs are you monitoring for these traffic numbers include packets
that are not exported via Netflow (broadcast, multicast etc)?
Regards,
Mario
> -Original Message-
> From: pmacct-discussion [mailto:pmacct-discussion-boun...@pmacct.net]
> On Behalf Of Vaggelis
Hi Thomas,
I guess you use sampled Netflow on the Cisco router and the renormalization
isn't working. In that case you may need to use pmacct's sampling_map directive
to tell it the sample rate. I didn't check (yet) why it is not working in our
system too, we just apply the renormalization
Hey Edward,
each file contains the data of one timebin. Flows spread over a timeframe
longer than one timebin cause pmacct to create/update multiple files. Depending
on how long your Netflow exporter keeps the flow records before it flushes them
to the collector, the created/updated files
Hi Paul,
this is based on my understanding of pmacct not possible out of the box. With
the tee plugin you can forward/duplicate the raw streams but not “process” them
and add data before forwarding.
Regards,
Mario
From: pmacct-discussion [mailto:pmacct-discussion-boun...@pmacct.net] On Behalf
Hey Stefan,
I use nfacctd with a custom plugin, never used pmacctd nor one of the SQL
plugins.
My guess is that you don't use aggregate[]: none and sql_history[]: 1d.
Whatever configuration proposal I give you is a shot in the dark.
To have the data of all interfaces in one table I would create
Hi Paolo,
thanks for taking care of this!
Regards,
Mario
-Original Message-
From: pmacct-discussion [mailto:pmacct-discussion-boun...@pmacct.net]
On Behalf Of Paolo Lucente
Sent: Mittwoch, 26. Februar 2014 18:49
To: pmacct-discussion@pmacct.net
Subject: Re: [pmacct-discussion]
Hi,
the print plugin doesn't output src_as_path (tested with 1.5.0rc2).
I verified a similar setup with the memory plugin successfully and checked the
source code, src/print_plugin.c misses src_as_path. Duplicating the lines for
as_path and updating them to reflect src_as_path worked for me.
17 matches
Mail list logo