Paolo,
Thanks for you reply. I really appreciate it.
I am actually using eth1 (I didn't include all the configs before)
These are all the configs:
----------------------------------------
daemonize: true
pidfile: /var/run/pmacctd.pid
syslog: daemon
interface: eth1
plugins: memory[inbound], memory[outbound]
aggregate[inbound]: dst_host
aggregate[outbound]: src_host
aggregate_filter[inbound]: dst net 10.10.20.0/24
aggregate_filter[outbound]: src net 10.10.20.0/24
imt_path[inbound]: /tmp/pmacct_inbound.pipe
imt_path[outbound]: /tmp/pmacct_outbound.pipe
plugin_buffer_size: 50240
plugin_pipe_size: 50240000
imt_buckets: 65537
imt_mem_pools_size: 1024000
----------------------------------------
br0 is bridging eth1 and eth2
and I am using eth0 as an administrative interface:
------------------------------------------------------------------------------------
1: eth1: <BROADCAST,MULTICAST,UP,10000> mtu 1500 qdisc htb qlen 100
link/ether 00:04:23:c2:5c:b9 brd ff:ff:ff:ff:ff:ff
2: eth2: <BROADCAST,MULTICAST,UP,10000> mtu 1500 qdisc htb qlen 100
link/ether 00:04:23:c0:c5:f6 brd ff:ff:ff:ff:ff:ff
3: eth0: <BROADCAST,MULTICAST,UP,10000> mtu 1500 qdisc pfifo_fast qlen 1000
link/ether 00:90:27:52:0d:e5 brd ff:ff:ff:ff:ff:ff
4: lo: <LOOPBACK,UP,10000> mtu 16436 qdisc noqueue
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
5: br0: <BROADCAST,MULTICAST,UP,10000> mtu 1500 qdisc noqueue
link/ether 00:04:23:c0:c5:f6 brd ff:ff:ff:ff:ff:ff
------------------------------------------------------------------------------------
Do you think that I should check br0 instead of eth1?
See also the dropped packets:
kill -SIGUSR1 26485
Nov 12 11:09:54 Deb-Bridge pmacctd[26485]: eth1: (1194883794) 1456262960
packets received by filter
Nov 12 11:09:54 Deb-Bridge pmacctd[26485]: eth1: (1194883794) 225517399 packets
dropped by kernel
Regards,
Mario Antonio
----- Original Message -----
From: "Paolo Lucente" <[EMAIL PROTECTED]>
To: "Mario Antonio Garcia" <[EMAIL PROTECTED]>, [email protected]
Sent: Wednesday, November 7, 2007 1:11:13 PM (GMT-0500) America/New_York
Subject: Re: [pmacct-discussion] Accounting accuracy
Hi Mario Antonio,
sorry for getting back to you so late. There have been a few reports
in the past pretty in line with what you are outlining in your email.
The root of the problem seems to relate somehow to bridged interfaces
and libpcap on Linux systems - nothing specifically related to pmacct.
I see in your config you are not specifying any interface - leaving
the SO to pick one for you; can you please play around this setting
and see if you get any benefit by forcing capturing packets off the
bridged interface itself or either the physical interfaces part of
the logical bridge?
Cheers,
Paolo
On Fri, Nov 02, 2007 at 07:48:03PM -0400, Mario Antonio Garcia wrote:
> Using Debian Etch with a customized kernel 2.6.22.6 (in bridge mode)
>
> I am testing pmacct with using the following configurations:
>
> --------------------------------------------------------------
> plugins: memory[inbound], memory[outbound]
> aggregate[inbound]: dst_host
> aggregate[outbound]: src_host
> aggregate_filter[inbound]: dst net 10.10.20.0/24
> aggregate_filter[outbound]: src net 10.10.20.0/24
> imt_path[inbound]: /tmp/pmacct_inbound.pipe
> imt_path[outbound]: /tmp/pmacct_outbound.pipe
> plugin_buffer_size: 50240
> plugin_pipe_size: 50240000
> imt_buckets: 65537
> imt_mem_pools_size: 1024000
> ---------------------------------------------------------------
>
> [ ... ]
>
> What else should I adjust in order to get accuracy when using pmacct?
> I thought that with plugin_pipe_size: 50240000 , I had plenty of space in the
> circular queue, so the core process could capture all the packets.
_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists
