Hi Ross, This same setup works well on a Linux for example. I see you daemonize both pmacctd daemons. Can you please keep them in foreground instead (daemonize: false) so that you can catch what happens?
Cheers, Paolo On Thu, Sep 23, 2010 at 01:06:58PM -0700, Ross Lawrie wrote: > Hi, > > I'm trying to set pmacct up on an OpenBSD 4.7 server running PF for its > firewall such that I can monitor traffic on each of my networks. From > the articles I've read in the wiki and in mailing lists the easiest way > to do this is to run multiple instances of pmacctd. The problem I'm > having is that processes after the first one don't seem to generate > data. > > For example, using the following two commands to start pmacctd: > > /usr/local/sbin/pmacctd -f /etc/pmacct/pmacctd_dmz.conf > /usr/local/sbin/pmacctd -f /etc/pmacct/pmacctd_internal.conf > > Here are the associated config files: > > ! > ! pmacctd_dmz.conf > ! > debug: false > daemonize: true > interface: em1 > plugin_buffer_size: 2048 > plugin_pipe_size: 2048000 > networks_file: /etc/pmacct/networks.def > plugins: memory[dmzin], memory[dmzout] > aggregate[dmzin]: dst_host > aggregate[dmzout]: src_host > imt_path[dmzin]: /tmp/dmz-in.pipe > imt_path[dmzout]: /tmp/dmz-out.pipe > > ! > ! pmacct_internal.conf > ! > debug: false > daemonize: true > interface: ste0 > plugin_buffer_size: 2048 > plugin_pipe_size: 2048000 > networks_file: /etc/pmacct/networks.def > plugins: memory[intin], memory[intout] > aggregate[intin]: dst_host > aggregate[intout]: src_host > imt_path[intin]: /tmp/internal-in.pipe > imt_path[intout]: /tmp/internal-out.pipe > > Using "pmacct -s -p <pipe>" I'm able to see data for whichever I start > first, however I get errors on the second started. Sometimes one or > both of the pipes belonging to the second process aren't created, if > they are created I get an error when trying to read from them: > > pmacct -s -p /tmp/dmz-out.pipe > INFO: Connection refused while trying to connect to '/tmp/dmz-out.pipe' > > Hopefully someone can see whatever I'm missing here. The version of > pmacct installed is 0.12.0 in case that's relevant. > > Thanks, > > Ross Lawrie > > > _______________________________________________ > pmacct-discussion mailing list > http://www.pmacct.net/#mailinglists _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
