Hi Paolo,
>> Last question so far: Why am I not seeing data in the database when
>> using "sql_history: 1" (or "10")? I have both "sql_history" and
>> "sql_refresh_time" set to the same amount of seconds.
>
> In super short, you can't set time-bins below 1 minute, anything below
> that will be rou
Hi Mathias,
Inline:
On Tue, Sep 05, 2017 at 03:05:55PM +0200, Mathias Gumz wrote:
> Exactly that is what I switched to and it does its job. :)
Great :)
> Last question so far: Why am I not seeing data in the database when
> using "sql_history: 1" (or "10")? I have both "sql_history" and
> "sq
> I see now. Can you try with 'nfacctd_time_new: true' It will cause
> time-binning to use arrival time of the flow to the collector (that
> time should be reasonably close to flow end time and stamp_updated).
Exactly that is what I switched to and it does its job. :)
Since I don't use it for rea
Hi Mathias,
I see now. Can you try with 'nfacctd_time_new: true' It will cause
time-binning to use arrival time of the flow to the collector (that
time should be reasonably close to flow end time and stamp_updated).
Let me know if any luck; if not, we can switch to unicast email and you
could se
Hi Paolo,
> On Tue, Aug 29, 2017 at 05:00:34PM +0200, Mathias Gumz wrote:
>> > Currently I have set the "sql_history" and "sql_refresh_time" to 60s. I
>> > wonder,
>> > how the algorithm works. "sql_refresh_time" seems to scan the cache and, if
>> > needed, writes/updates an entry in the current
Hi Mathias,
Inline:
On Tue, Aug 29, 2017 at 05:00:34PM +0200, Mathias Gumz wrote:
> > Currently I have set the "sql_history" and "sql_refresh_time" to 60s. I
> > wonder,
> > how the algorithm works. "sql_refresh_time" seems to scan the cache and, if
> > needed, writes/updates an entry in the cu
> Currently I have set the "sql_history" and "sql_refresh_time" to 60s. I
> wonder,
> how the algorithm works. "sql_refresh_time" seems to scan the cache and, if
> needed, writes/updates an entry in the current bin. But what exactly is
> "sql_history" doing? Will there be only "one" entry of a cer
Hi Paolo,
> Can you please post your config? Gut feeling says you may be missing the
> sql_history directive (essentially indicate what is the time-binning
> period).
Yes, adding "sql_history" (and "sql_refresh_time") + having "stamp_inserted"
and "stamp_updated" columns in the schema helps. Sin
Hi Mathias,
Can you please post your config? Gut feeling says you may be missing the
sql_history directive (essentially indicate what is the time-binning
period).
Paolo
On Mon, Aug 28, 2017 at 03:36:02PM +0200, Mathias Gumz wrote:
> Hi,
>
> we are using nfacctd to collect NAT events (event
Hi,
we are using nfacctd to collect NAT events (event types 4 and 5,
https://www.iana.org/assignments/ipfix/ipfix.xml#ipfix-nat-event-type) into a
MySQL instance. We also want to rotate the table on a daily basis:
sql_table[natev]: natev_%Y_%m_%d
sql_table_schema[natev]: /path/to/schem
10 matches
Mail list logo