Hi folks,
I'm just setting up pmacct on my network to count bytes,protocol,ip,port for
my hosting servers for monthly accounting.
I have a leaf machine as my router/firewall.
Leaf Router
Internet -- 100Mbit --- eth0 - eth1 --- 1000Mbit --- Internal LAN
All my servers are connected to eth1 via gigabit switch.
I'm going to store the output in a dedicted mysql server.
I have a couple of questions.
For only counting bytes,protocol,ip,port do I just need a v1 sql table?
I wish to be able to at least store down to the hourly data transferred per
IP/port of my servers.
I was thinking of building queries that roll an hours worth of counts into a
table then deleting the original data, has anyone tried/done this?
Should I use a filter for my ip range? (I don't quite understand the filter
side of things, if my class c is 202.45.102.0/24 is that what I add as an
aggregate_filter)
Here is what I plan to run as my config has anyone got any tips on what I
should add?
debug: false
logfile: /var/log/pmacct.log
daemonize: true
promisc: false
interface: eth1
plugins: mysql[in], mysql[out]
aggregate[in]: dst_port,dst_host,proto
sql_table[in]: acct_in
aggregate[out]: src_port,src_host,proto
sql_table[out]: acct_out
sql_host: xx.xx.xx.xx
sql_db: pmacct
sql_table_version: 1
sql_passwd: xxxx
sql_user: pmacct
sql_refresh_time: 10
sql_optimize_clauses: true
sql_history: 5m
sql_history_roundoff: mh
Thanks in advance
Adam
_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists
