I would have to sheepishly admit at this stage that after the upgrade I failed to kill the first nfacctd process completely and upon further inspection I had TWO processes running, which I would assume was giving me the increase in data stats.
This does raise one question for me though, how come the second process was able to start and access the stats from the first process to be able to write them to the DB as well. I haven't done a lot of programming, but I'm fairly sure that only one process can bind to a port, so if both of the instances were started with the same config file, they would both attempt to use the same TCP port. The first process would succeed, the second would fail. This should mean that only one nfacctd process is receiving the netflow packets from the router, but both of the running processes are able to write the same stats to the SQL DB ? Is this because it uses some shared memory for communication between the process that accepts the netflow packets and the second process that writes to the DB ? I can't see any error messages in the logs to indicate that the second process started and was unable to bind to the correct port either ? At this point everything appears to be back to normal with the 64-bit counters. Thanks for the pointer in the right direction. regards, Tony. --- On Fri, 24/12/10, Paolo Lucente <[email protected]> wrote: > From: Paolo Lucente <[email protected]> > Subject: Re: [pmacct-discussion] potentially missing data > To: "Tony" <[email protected]> > Cc: [email protected] > Received: Friday, 24 December, 2010, 9:35 PM > Hi Tony, > > If the C7600 is the only NetFlow exporter to nfacctd, > traffic at > the router is counted once (ie. collected ingress-only) and > a single > nfacctd writing to the 'internet' table you should never > get into > the situation of overestimated counters. pmacct by itself > is not > able to duplicate traffic counters; and i've not been > repored so > far similar behaviours from C7600 with SRC/SRD/SRE codes _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
