I know this is an oldie, but I'm very conservative when it comes to upgrading. Here is my experience with this problem:
I've been running nfacctd - pmacct version 0.10.3 - for quite some time. I use a memory plugin with interface to Cricket for real time graph presentation and MySQL logging for batch processing of the stored flows. From time to time I've been executing fairly complex MySQL queries (resulting in high load on the Nfacct host - 2 to 4 - but lots of free CPU time) while nfacct is running and this has been no problem. Around 2.5 hours ago I upgraded to 0.11.3 and then had to made some changes to some MySQL tables, resulting in fairly high load (around 2.5, but still with a lot of CPU left). The result was dramatic during the single hour I had 0.11.3 running: During the first 15 minutes (when the load was mostly low as I just created some tables for later use) I received 4 messages like the ones below. After starting the MySQL jobs and for the coming 45 minutes I had around 25000 messages, all on the format: Mar 14 16:16:23 dump02 nfacctd[9651]: WARN: expecting flow '3982342489' but received '3982343156' collector=(null):2100 agent=193.156.90.68:1792 Mar 14 16:16:23 dump02 nfacctd[9651]: WARN: expecting flow '3982343156' but received '3982343533' collector=(null):2100 agent=193.156.90.68:1792 I have 3 distinct sources of Netflow/cFlow packets and all three had "lost reports" like this. All plugins had a dramatic decrease in reported flow data for all IPs (my estimate is around 60% lost flow information during these 45 minutes). During that time I tried desperately to troubleshoot the possible cause. Finally I gave up and reverted to 0.10.3 (while the MySQL jobs were still running). I received no further warning messages and the Cricket graphs went immediately back to normal while the MySQL jobs continued running with unaltered load (they are still running). There are 0 errors on the receiving interfaces. There were no other recorded network related incidents during that period. I also have another installation on a site with much less traffic and more moderate load on the Nfaccd host and there I have recorded one (1) such message with pmacct 0.11.3 (which I will happily write off as a lost UDP packet). There are no interface errors on this host either. Any ideas on this? all the best, -- Inge > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] > On Behalf Of Paolo Lucente > Sent: 16. november 2006 02:11 > To: [email protected] > Subject: Re: [pmacct-discussion] nfacctd warnings > > Hi Guys, > reviewing quickly the code, seems like there is something not > working properly on the nfacctd side - while on the sfacctd > everything is reported to be working well. I'll fix that in > the next release and actually pleas ignore it. Just to > manually double check for any packet loss, when using NetFlow > v5, you should expect that "but received x" value increasing > by some 30 units. > > Regarding the "null", don't worry, everything is ok: it > should just be more polite and show you a 0.0.0.0, that's all it. > > Cheers, > Paolo > > On Thu, Nov 16, 2006 at 01:06:38AM +0200, Peter Nixon wrote: > > On Wed 15 Nov 2006 23:27, Peter Nixon wrote: > > > Hi Guys > > > > > > I am currently getting the following ALOT in my logs. > > > > > > nfacctd[10115]: WARN: expecting flow '38601682' but > received '38601711' > > > collector=(null):2100 agent=x.x.x.x:0 > > > > > > Is it one of my ciscos playing up or a problem with nfacctd?? > > > > Interestingly when I "nfacctd -L y.y.y.y" on the primary ip on the > > interface instead of an alias ip (and change the ciscos to send to > > that ip obviously) collector no longer shows as "null": > > > > WARN: expecting flow '35253' but received '35282' > > collector=y.y.y.y:2100 agent=x.x.x.x:0 > > > > It appears to be unrelated to the actual problem though as > the error > > still occurs.. I have also rebooted the ciscos so it doesnt > appear to be that.. > > > > Any ideas? I am running pmacct-0.11.1-3.1 > > _______________________________________________ > pmacct-discussion mailing list > http://www.pmacct.net/#mailinglists > _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
