Chris, Thanks for following up.
Memory and CPU usages are find. I am reserving around 100 MB of memory for pmacct. It seems huge but I wanted to be in the safe side. I am doing further tests, and a rate of 1 Gig each 10 minutes results are fine (I am getting/resetting pmacct each 10 Minutes. But a rate of 2.5 Gigs or more each 10 minutes, I get dropped packets. I was testing a the same time Ntop, Darkstar, IPaudit, Ipfm, and Pmacct. I guess using all these programs at the same time could be an issue. Thanks for the hint about memory-mapped pcap interface used by ntop, I will look into that. Regards, Mario Antonio ----- Original Message ----- From: "Chris Wilson" <[EMAIL PROTECTED]> To: "Mario Antonio Garcia" <[EMAIL PROTECTED]>, [email protected] Sent: Wednesday, November 28, 2007 1:35:43 PM (GMT-0500) America/New_York Subject: Re: [pmacct-discussion] Accounting accuracy Hi Mario, On Mon, 12 Nov 2007, Mario Antonio Garcia wrote: > Thanks a lot for your reply. > > Yes, I see droppped packets: > kill -SIGUSR1 26485 > Nov 12 11:09:54 Deb-Bridge pmacctd[26485]: eth1: (1194883794) 1456262960 > packets received by filter > Nov 12 11:09:54 Deb-Bridge pmacctd[26485]: eth1: (1194883794) 225517399 > packets dropped by kernel > > Besides of tying pmacct to the iptables QUEUE, do you know of any other > solution? Check the load on the box. It should really never be above 100% CPU or 1.0 load average or you will get problems. pmacct should have very low CPU usage, less than 20%. Also IMT should not be the source of your data loss, but if you have the tables polled very frequently then it might be. Finally you could look into using the memory-mapped pcap interface used by ntop, which is supposedly much more efficient but will probably require at least a kernel patch. None of this is guaranteed to lose no packets at all. The only way to do that is to hook into the firewall, which basically means using iptables QUEUE on Linux. Cheers, Chris. -- Aptivate | http://www.aptivate.org | Phone: +44 1223 760887 The Humanitarian Centre, Fenner's, Gresham Road, Cambridge CB1 2ES Aptivate is a not-for-profit company registered in England and Wales with company number 04980791. _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
