Hi,
I've got a feeling I'm probably doing something really stupid here, but
I can't get as_src and as_dst populated by anything other than 0. Setup:
1) Border router: BGP ID 192.168.1.9, talking on 192.168.2.1
2) sflow exporter (on switch in front of router): 192.168.1.8
3) sfacct bgp daemon on: 192.168.2.9
sfacct.conf:
!daemonize: true
plugins: mysql
sql_refresh_time: 60
sql_history: 5m
sql_history_roundoff: mh
sql_table_version: 6
sql_optimize_clauses: true
sql_table: xxxxxx
sql_user: xxxxxx
sql_passwd: xxxxxx
sql_db: xxxxxx
sfacctd_as_new: bgp
aggregate: src_host, dst_host, src_as, dst_as, vlan
!bgp_daemon_msglog: true
bgp_aspath_radius: 4
bgp_daemon: true
bgp_daemon_ip: 192.168.2.9
bgp_agent_map: /usr/local/etc/agent_to_peer.map
bgp_daemon_port: 179
agent_to_peer.map:
id=192.168.2.1 ip=::ffff:192.168.1.8
id=192.168.2.1 ip=192.168.1.8
id=192.168.1.9 ip=::ffff:192.168.1.8
id=192.168.1.9 ip=192.168.1.8
Tried to cover all bases with it.
Router is a quagga box, configured as thus:
neighbor 192.168.2.9 remote-as XXXX
neighbor 192.168.2.9 description flow collector
neighbor 192.168.2.9 update-source 192.168.2.1
neighbor 192.168.2.9 route-reflector-client
BGP peer works:
INFO ( default/core/BGP ): [Id: 192.168.1.9] u Prefix: '203.22.83.0/24'
Path: '3356 4637 1221' Comms: '3356:3 3356:22 3356:86 3356:575 3356:666
3356:2011' EComms: '' LP: '100' MED: '0' Nexthop: '212.X.Y.Z'
Here is what it writes to MySQL:
DEBUG ( default/mysql ): INSERT INTO `acct_cust` (stamp_updated,
stamp_inserted, vlan, ip_src, ip_dst, as_src, as_dst, packets, bytes)
VALUES (FROM_UNIXTIME(1285420431), FROM_UNIXTIME(1285420200), 1234,
'X.Y.Z.A', '92.42.56.4', 0, 0, 1, 1514)
As you can see, no as_src or as_dst
I've confirmed with tcpdump that the packets from the switch (sflow) are
coming from 192.168.1.8 as expected, I've confirmed the BGP packets are
coming from 192.168.2.1 as expected.
It's driving me nuts at the moment as to why it won't work, so all help
is much appreciated.
Thanks,
--
Karl Austin
_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists
