Hi Falk, > database with an 0.0.0.0 as ip_src (or ip_dst). What's about this?
This is because of the aggregation. The incoming sflow is process by both plugins in/out. The first plugin looks only for vlan and destination ip address. Thus the ip_src field is 0.0.0.0. Same with the second plugin that looks only for vlan and source address which results in ip_dst field being 0.0.0.0 In general pmacct only fills fields that it aggregates by. vlan,dst_host means only vlan, dst_host and the mandatory fields (bytes, packets, agent_id). Otherwise no aggregation could be done. For example you hav two flows: 1. src: 1.2.3.4, dst: 5.6.7.8, pkt: 10, bytes: 640 2. src: 1.2.3.4, dst: 9.8.7.6, pkt: 10, bytes: 640 Your aggregation for the source address would be ip_src: 1.2.3.4, ip_dst: 0.0.0.0, packets: 20, bytes: 1280 If you fill ip_dst you will need 2 db records which would be automatically aggregate: vlan,ip_src,ip_dst Your aggregation of course only makes sense if you have an aggregate_filter that filters for your networks. If 1.2.3.4 was an ip of your network range and 5.6.7.8,9.8.7.6 is outside your aggregation would result in only one db record. If you did not filter it would result in 3 records, even one more as with aggregate:vlan,ip_src,ip_dst Cheers, Bernd > Hi, > > Am 02.08.2011 um 12:43 schrieb Bernd Bornkessel: > > > you should see something like this in your log: > > Aug 2 12:34:10 accsrv sfacctd[1839]: WARN ( all/memory ): SUM aggregation > is to be used alone. Resetting other aggregation methods. > > Argh, my fault. Thank you for your hint. I really should be able to find > this out on my self. Sorry for the noise. > > > To lower the number of db records you could split aggregation: > > That's a good idea! Works fine. But now I have some weird entries in the > database with an 0.0.0.0 as ip_src (or ip_dst). What's about this? > > Schönen Gruß aus Duisburg / Regards from Duisburg, > > Falk Brockerhoff > smartTERRA Geschäftsführung / smartTERRA CEO > > -- > Kontaktmöglichkeiten / Postal Address, Contact: > smartTERRA GmbH, Postfach 170353, 47183 Duisburg Telefon 0211-547 610 00, > Telefax 0211-547 610 01 Meine Durchwahl / my phone: 0211-547 610 05 > > Sitz der Gesellschaft / Principal Office: > Vogelsanger Weg 91, 40470 Düsseldorf, Deutschland GF Falk Brockerhoff, > Amtsgericht Düsseldorf HR B 65811 > > > _______________________________________________ > pmacct-discussion mailing list > http://www.pmacct.net/#mailinglists _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
