Hi, After compiling with 64-bit I am getting larger values, but now I seem to be getting up to TWICE as much as I should ? Is this a known bug, or something that I should have changed when I upgraded ?
The link has continued to be used at 10Mbps, so the usage each hour should remain around 4.5GB. The numbers between 0200-0400 are probably correct as there was a slight lull in usage at this time to an average of perhaps roughly 6Mbps. I changed to the 64-bit 0.12.4 version of pmacct at 2330. mysql> select bytes/1000000000 as GB, stamp_inserted, stamp_updated from internet where agent_id = 1 and stamp_inserted > '2010-12-23 14:00:00' and ip_dst = 'x.y.23.200' order by 3 desc; +---------+---------------------+---------------------+ | GB | stamp_inserted | stamp_updated | +---------+---------------------+---------------------+ | 10.8867 | 2010-12-24 09:00:00 | 2010-12-24 10:00:01 | | 9.3094 | 2010-12-24 08:00:00 | 2010-12-24 09:00:01 | | 11.4398 | 2010-12-24 07:00:00 | 2010-12-24 08:00:01 | | 8.8432 | 2010-12-24 06:00:00 | 2010-12-24 07:00:01 | | 4.8371 | 2010-12-24 05:00:00 | 2010-12-24 06:00:01 | | 4.7354 | 2010-12-24 04:00:00 | 2010-12-24 05:00:01 | | 3.1966 | 2010-12-24 03:00:00 | 2010-12-24 04:00:01 | | 2.2933 | 2010-12-24 02:00:00 | 2010-12-24 03:00:01 | | 4.8357 | 2010-12-24 01:00:00 | 2010-12-24 02:00:01 | | 6.9992 | 2010-12-24 00:00:00 | 2010-12-24 01:00:01 | | 0.2545 | 2010-12-23 23:00:00 | 2010-12-24 00:00:01 | | 0.5420 | 2010-12-23 22:00:00 | 2010-12-23 23:00:01 | | 0.5429 | 2010-12-23 21:00:00 | 2010-12-23 22:00:01 | | 0.7547 | 2010-12-23 20:00:00 | 2010-12-23 21:00:01 | | 2.9795 | 2010-12-23 19:00:00 | 2010-12-23 20:00:01 | | 2.3076 | 2010-12-23 18:00:00 | 2010-12-23 19:00:01 | | 0.1109 | 2010-12-23 17:00:00 | 2010-12-23 18:00:01 | | 0.2496 | 2010-12-23 16:00:00 | 2010-12-23 17:00:01 | | 0.1036 | 2010-12-23 15:00:00 | 2010-12-23 16:00:01 | +---------+---------------------+---------------------+ 19 rows in set (0.00 sec) Any ideas ? Thanks, Tony. --- On Thu, 23/12/10, Paolo Lucente <[email protected]> wrote: > From: Paolo Lucente <[email protected]> > Subject: Re: [pmacct-discussion] potentially missing data > To: [email protected] > Received: Thursday, 23 December, 2010, 6:22 PM > Hi Tony, > > The TCAM utilization you posted seems to suggest the C7600 > is > OK; but having a look to how the NetFlow export is > configured > on the box (interface + global commands) wouldn't hurt. > > What is interesting is the huge jumps in the bytes counter > in > the table you posted; was pmacct compiled for 64-bit > counters? > can you post your pmacct configuration? can you also post > the > SQL query you use in order to get that table? > > A propo of the math: it appears to my eyes 10Mbps * 8 * > 3600 > is much more than 4-5GB/hr? > > Cheers, > Paolo > > > On Wed, Dec 22, 2010 at 08:33:57PM -0800, Tony wrote: > > Hi, > > > > I have just noticed that the results being returned by > pmacct do not match up with the real data. > > > > The configuration is: > > > > Internet -- c7609 -- 10M fiber -- c3550 -- customer > > > > We are exporting netflow stats from the Cisco 7609 and > I am aware of the limitations on this platform, but the > total data through the 7609 that we are trying to export > flow stats for is in the order of 50Mbps (max) so hopefully > we should not be exceeding anything on the box. > > > > It doesn't LOOK like the 7609 is dropping any stats > (although I am no expert on 7609 netflow): > > > > #show ip flow export > > Flow export v9 is enabled for main cache > > Export source and destination details > : > > VRF ID : Default > > Source(1) > 10.1.1.115 (Vlan2) > > Destination(1) 10.1.1.38 > (6789) > > Version 9 flow records > > 13267046 flows exported in 1142685 > udp datagrams > > 0 flows failed due to lack of export > packet > > 0 export packets were sent up to > process level > > 1 export packets were dropped due to > no fib > > 0 export packets were dropped due to > adjacency issues > > 0 export packets were dropped due to > fragmentation failures > > 0 export packets were dropped due to > encapsulation fixup failures > > 0 export packets were dropped > enqueuing for the RP > > 0 export packets were dropped due to > IPC rate limiting > > 0 export packets were dropped due to > Card not being able to export > > > > > > #show mls netflow table-contention summary > > Earl in Module 6 > > Summary of Netflow CAM Utilization (as a percentage) > > ==================================================== > > TCAM Utilization > : 1% > > ICAM Utilization > : 0% > > Netflow Creation Failures > : 0 > > Netflow CAM aliases > : 0 > > > > > > The difference is quite large. The number from pmacct > are (from MySQL exported data): > > > > > +------------+---------------------+---------------------+ > > | bytes | stamp_inserted > | stamp_updated > | > > > +------------+---------------------+---------------------+ > > | 3505877423 | 2010-12-23 11:00:00 | 2010-12-23 > 12:00:01 | > > | 114559834 | 2010-12-23 10:00:00 | 2010-12-23 > 11:00:01 | > > | 107033171 | 2010-12-23 09:00:00 | 2010-12-23 > 10:00:01 | > > | 2248788510 | 2010-12-23 08:00:00 | 2010-12-23 > 09:00:01 | > > | 730948403 | 2010-12-23 07:00:00 | 2010-12-23 > 08:00:01 | > > | 1432262718 | 2010-12-23 06:00:00 | 2010-12-23 > 07:00:01 | > > | 542630778 | 2010-12-23 05:00:00 | 2010-12-23 > 06:00:01 | > > | 546202726 | 2010-12-23 04:00:00 | 2010-12-23 > 05:00:01 | > > | 505622657 | 2010-12-23 03:00:00 | 2010-12-23 > 04:00:01 | > > | 545262871 | 2010-12-23 02:00:00 | 2010-12-23 > 03:00:01 | > > | 2704448981 | 2010-12-23 01:00:00 | 2010-12-23 > 02:00:01 | > > > +------------+---------------------+---------------------+ > > > > Whereas the number from the interface stats on the > 3550 are (from PRTG): > > > > > > Date Time? Traffic out (volume) > > 23/12/2010 11:00:00 AM - 12:00:00 PM > 3,637,126 KByte > > 23/12/2010 10:00:00 AM - 11:00:00 AM > 4,265,164 KByte > > 23/12/2010 9:00:00 AM - 10:00:00 AM > 4,266,288 KByte > > 23/12/2010 8:00:00 AM - 9:00:00 AM > 4,137,007 KByte > > 23/12/2010 7:00:00 AM - 8:00:00 AM > 4,290,950 KByte > > 23/12/2010 6:00:00 AM - 7:00:00 AM > 4,705,733 KByte > > 23/12/2010 5:00:00 AM - 6:00:00 AM > 4,861,328 KByte > > 23/12/2010 4:00:00 AM - 5:00:00 AM > 4,809,456 KByte > > 23/12/2010 3:00:00 AM - 4:00:00 AM > 4,564,060 KByte > > 23/12/2010 2:00:00 AM - 3:00:00 AM > 4,855,658 KByte > > 23/12/2010 1:00:00 AM - 2:00:00 AM > 4,865,965 KByte > > > > > > The customer is flogging the 10Mbps link at full speed > (which is fine, not concerned about that, they are entitled > to) and so the correct figure is as reported by the > interface stats of between 4-5GB per hour. If you do the > math, this works out correct, 10Mbps = 4.5GB/hr. > > > > The results from pmacct are way short of what they > should be. > > > > I'm open to suggestions on where to look to diagnose > what is going on and why pmacct is not correct. > > > > I'm running 0.12.0rc2 and will look at upgrading in > the next week or so, but I'm not sure that will make any > difference (are there any bugs that might be causing this > ?). > > > > I don't know if it is just stats for this customer > being affected, but I would suspect that it is probably > showing less than it should across the board. > > > > Apologies if this would be better directed at the > c-nsp list, but I don't think the problem is on the Cisco > side (although I'm happy to investigate this further if > anyone can point in the right direction). > > > > > > Thanks, > > Tony. > > > > > > > > > > _______________________________________________ > > pmacct-discussion mailing list > > http://www.pmacct.net/#mailinglists > > _______________________________________________ > pmacct-discussion mailing list > http://www.pmacct.net/#mailinglists > _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
