Hi, we want to you sfacctd for accounting and billing purposes in our network. I set up a test installation with a router sending SFlow and a Debian 6.0 system with pmacct-0.14.0rc1 and a mysql backend as the collector.
Everything works fine as long as I don't use the aggregate filters. Without aggregate filtering sfacctd will write the data to the database. But as we need to have filters for our own networks, I tried to use the aggregate filters. But as soon as I activate them, there will be no data written to the database. The problem exists with all backends (mysql, memory, sqlite etc.). Thus I assume the filters not matching. But according to the sent flows and the configured filters, there should be flow data afer filtering. My configuration: ! ! Daemon ! daemonize: true pidfile: /var/run/sfacctd.pid !syslog: daemon logfile: /var/log/sfacctd.log sfacctd_port: 6343 ! ! ! Selected plugins ! plugins: mysql[inbound], mysql[outbound] ! ! ! Aggregation by plugin ! aggregate[inbound]: dst_host aggregate[outbound]: src_host aggregate_filter[inbound]:(dst net 192.76.141.0/24 or dst net 194.55.246.0/23 or dst net 195.246.160/19 or dst net 88.215.224.0/19 or dst net 62.93.212.0/23 or dst net 62.93.246.0/23 or dst net 88.215.192.0/19) aggregate_filter[outbound]:(src net 192.76.141.0/24 or src net 194.55.246.0/23 or src net 195.246.160/19 or src net 88.215.224.0/19 or src net 62.93.212.0/23 or src net 62.93.246.0/23 or src net 88.215.192.0/19) ! ! ! SQL parameters ! sql_host: localhost sql_user: sfacct sql_passwd:abcdefg sql_db: test sql_table: SFACCT sql_refresh_time: 300 sql_history: 5m sql_history_roundoff: m sql_table_version: 7 sql_recovery_logfile: /var/lib/pmacct/recovery_sfacctd_log ! ! ! I also tried using the filters without brackets - same problem. I captured some flow packets you can download a small pcap file from my dropbox: http://dl.dropbox.com/u/20778197/sflow.pcap Any suggestions? Thanks in advance! -Bernd _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
