Hi Can I make changes to pre_tag.map and make nfacctd to reread file without losing current flows?
(I measure ip adresses over 24h, so i would lite to keep the stats) Cheers /Tobias Paolo Lucente wrote: > VERSION. > 0.8.4 > > > DESCRIPTION. > pmacct is a small set of tools to account and aggregate IPv4 and IPv6 > traffic; aggregation revolves around the key concept of primitives (VLAN > id, source and destination MAC addresses, hosts, networks, AS numbers, > ports, IP protocol and ToS/DSCP field are supported) which may be > employed alone or arbitrarily combined with others to form complex > aggregation methods; support for custom historical breakdown, packet > tagging, filtering and sampling. Aggregates can be stored into memory > tables, SQL databases (MySQL or PostgreSQL) or simply pushed to stdout. > Data is collected either using libpcap (and optionally promiscuous mode > of the listening interface) or reading Netflow v1/v5/v7/v8/v9 packets > coming from the network. > > > HOMEPAGE. > http://www.ba.cnr.it/~paolo/pmacct/ > > > DOWNLOAD. > http://www.ba.cnr.it/~paolo/pmacct/pmacct-0.8.4.tar.gz > > > CHANGELOG. > + Added support for NetFlow v7/v8. The Version 7 (v7) format is > exclusively supported by Cisco Catalyst series switches equipped > with a NetFlow feature card (NFFC). v7 is not compatible with Cisco > routers. The Version 8 (v8) format adds (with respect to older v5/v7 > versions) router-based aggregation schemes. > + Added the chance to tag packets basing on NetFlow v8 aggregation > type field. As the keyword suggests, it will work successfully just > when processing NetFlow v8 packets. Useful to split - backend side - > data per aggregation type. > + pmacct client now is able to ask for the '0' (that is, untagged > packets) tag value. Moreover, all 'sum' aggregations (sum_host, > sum_net, sum_as, sum_port) can now be associated with both > Pre/Post-Tagging. > ! Fixed a serious memory leak located in the routines for handling > NetFlow v9 templates. While the bug was needing certain conditions > to manifest, anyone using NetFlow v9 is strongly encouraged to > upgrade to this version. All previous versions were affected. > ! Some gcc4 compliance issues have been solved. The source code is > known to work fine on amd64 architectures. Thanks very much to > Marcelo Goes for his patch. > ! Engine Type/Engine ID fields were not correctly evaluated when using > NetFlow v5 and Pre-Tagging. The issue has been fixed. > ! Long comments in the Ports Definition File were causing some > incorrect error messages. However it seems the file were processed > correctly. Thanks to Bruno Mattarollo for signalling the issue. > ! Minor fix to plugins hooking code. The reception of sparse SIGCHLD > signals were causing the poll() to return. The impact was null. The > issue has been fixed by ignoring such signals. > > NOTES. > None. > > Cheers, > Paolo > > > _______________________________________________ > pmacct-discussion mailing list > [email protected] > http://muffin.area.ba.cnr.it/mailman/listinfo/pmacct-discussion
