Hi Matt, Good, you already tried out what would have been my first suggestion. Something else i would recommend traffic load permitting: disable buffering (plugin_buffer_size) whenever testing a new configuration: to be sure nothing remains trapped within the buffers giving the feeling something doesn't work properly.
Which version of nfacctd are you using? Which version of NetFlow are you using? Would it be possible to send over privately some NetFlow datagrams (full-size) in libpcap format which are containing traffic not being reported? If this is NetFlow v9 be sure to include the template in the capture file. Cheers, Paolo On Thu, Apr 30, 2009 at 03:36:59PM -0700, Matt Lawson wrote: > > Hi, > > I am using nfacctd more or less successfully, however I wanted to try > narrowing down my results by using the aggregate_filter. I created the name > 'total' because aggregate_filter can't be applied globally. > > So I tried the following config: > > > ! debug: true > daemonize: false > nfacctd_disable_checks: true > plugins: print[total] > aggregate[total]: dst_host, dst_port, src_host, src_port, proto > aggregate_filter[total]: dst port 80 > print_cache_entries: 1000001 > print_refresh_time: 10 > plugin_pipe_size: 10240000 > plugin_buffer_size: 10240 > ! interface: eth0 > nfacctd_ip: w.x.y.z (sanitized) > nfacctd_port: 5000 > pidfile: /var/run/nfacctd > logfile: /var/log/nfacctd.log > > > Unfortunately, it captures very, very little data. Only a few records > compared to what it should. If I just take out the "aggregate_filter" line > it works fine. > > I have tried with and without the "interface eth0" and with and without > debug, no help there. > > I saw an earlier post describing a similar problem with sFlow to add "vlan > and ..." or "mpls and ..." to the filter but that didn't help. > > Any ideas? TIA. > > Thanks. > > > > > _______________________________________________ > pmacct-discussion mailing list > http://www.pmacct.net/#mailinglists _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
