Hello everybody. I am having some little issues with pmacct.I have a gentoo linux server with a NIC in promiscuous mode monitoring the traffic generated by a cisco router connected to a 2 megabits HDSL line. My problem is that querying the pmacctd mysql table doesn't give me the same values that SNMP queries give me on the router ethernet interface: for example, querying the router interface with SNMP gives me a value of 500 megabytes in a day, and querying the pmacctd mysql table gives me a value of, say, 50 megs in a day, so it definitely is not a rounding issue.
To check the total traffic generated from the midnight by the router I do the following things: - with SNMP I calculate the sum of the average traffic passed through the router's interface (written on the mrtg log file) from the midnight to the last check's time;
- with pmacct and mysql I do the following query: select sum(bytes) as traffico from acct \ where stamp_updated > 'yyyy-mm-dd 00:00:00' \ and stamp_updated < 'now()'I am sure that the SNMP traffic detection is correct because the amount of traffic indicated by the SNMP queries on the router is more or less the same to the one that the Telecom detects and makes me pay.
The hardware I am using is pretty powerful: 2x Intel Xeon 2.80 GHz, 2GB RAM, 15000 rpm SCSI disks in hardware raid, so I don't think that hardware is my bottleneck in this case (even if I have to say that pmacctd is not the only daemon running on the machine :P)...
I also removed all the keys from the mysql table and use mysql_dont_try_update to avoid mysql performance issues.
This is the config file of my pmacctd: ---------------------------------------------------------- daemonize: true interface: eth1 promisc: true aggregate: src_host,dst_host,src_port,dst_port,proto plugins: mysql plugin_pipe_size: 102400000 plugin_buffer_size: 102400 sql_db: pmacct sql_table: acct sql_table_version: 1 sql_passwd: <password> sql_user: <username> sql_refresh_time: 60 sql_history: 1h sql_history_roundoff: h sql_dont_try_update: true sql_optimize_clauses: true sql_multi_values : 1024000 ---------------------------------------------------------- What do you think I am doing wrong? Are there any other things I could try to reach my goal? Any help and suggestion would be very appreciated. :) -- Fabrizio Vecchi - Network and Software Engineer - Alba S.T. srl Phone +39 045 9690485 - Fax +39 045 9690485 - SIP:[EMAIL PROTECTED] Disclaimer: http://www.alba.st/disclaimer
smime.p7s
Description: S/MIME Cryptographic Signature
_______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
