Hi, can you please outline which network device are you exporting your NetFlow from, which NetFlow version are you actually using and what's roughly the rate of the exported flows (or NetFlow packets) per second?
Can you please also: a) post your configuration, if using any? b) post the result for a "ps auxw | grep nfacctd" - or equivalent? Lost NetFlow packets might be the result of a number of factors, including problems with the collector application (or the underlying SO), CPU usage of the network device and drops on the network. Hope we can rule out some of the above by having some more informations. Cheers, Paolo On Tue, May 08, 2007 at 04:55:46PM -0400, [EMAIL PROTECTED] wrote: > I'm currently working with a high-traffic network, and 4 core routers > dumping netflow data to a nfacctd instance. > > I've noticed many instances of the following messages in my logs: > > May 8 14:54:18 flow0 nfacctd[8648]: WARN: expecting flow '2029396353' > but received '2029396443' collector=xxx.xxx.xxx.xxx:xxxx > agent=xxx.xxx.xxx.xxx:0 > > Packet captures indicate that I am indeed receiving flow 2029396353 (or > whatever the current flow id is). > > My processor usage is currently ~111% (on a 2 CPU system) and memory > consumption is low. > > Does anyone have configuration tips that may allow for prevention of > lost netflows? > > Any advice/discussion is welcome. > > Thanks, > > Fleet. _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
