Hi Chris, On Sun, Jun 14, 2009 at 02:25:10PM +0300, Chris Wilson wrote:
> I don't think it can. For example, how would we write the configuration? > Let's say we just want to zero (not aggregate on) the destination IP for > flows less than 1000 bytes. We could try: > > plugins: mysql[with_dst], mysql[without_dst] > aggregate[with_dst]: src_host, src_port, dst_host, dst_port, proto > aggregate[without_dst]: src_host, src_port, dst_port, proto > sql_preprocess[with_dst]: minb = 1000 > sql_preprocess[without_dst]: maxb = 1000 > > but the flow aggregates are not the same for both plugins, so we can't > ensure that any flow ends up in one plugin or the other but not both or > neither. Actually, you are right. The only alternative, though un-scalable, is the one mentioned previously: same aggregation, two SQL tables, complementary 'sql_preprocess' directives. This implies having a script called from the crontab doing the sub- aggregation job and eventually putting these new aggregates in the table featuring the sql_preprocess configured with minb = 1000. But this is how the problem can be tackled with what we have. With the only nice way to do this being doing sub-aggregation at the sql_preprocess stage. 0.12.0p2 should be highly feasible. Cheers, Paolo _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
