I just (painfully) ran into a situation where I had added multiple
aggregation plugins to a configuration, for example:
! ...
aggregate[in]: dst_host
aggregate[out]: src_host
aggregate_filter[in]: dst net 192.168.1.0/24
aggregate_filter[out]: src net 192.168.1.0/24
plugins: pgsql[in], pgsql[out]
! ...
sql_recovery_logfile: /var/log/pmacct/recovery.dat
! ... EOF
But when trying to recover using pmpgplay, it would recover only records
that match the template. So if the template header says that the data is
for dst_host, then the data that has null ip_dst but has an ip_src would
fail as you can't insert an empty IP address.
To prevent this in the future I've fixed my config to do:
sql_recovery_logfile[in]: /var/log/pmacct/recovery-in.dat
sql_recovery_logfile[out]: /var/log/pmacct/recovery-out.dat
I think this is a trap that other people might fall into...
Wim
