Hi Anatoly, On Tue, Aug 23, 2011 at 11:14:16AM +0400, Anatoly Bashmakov wrote:
> As far as I understand, stamp_inserted and stamp_updated are fields > related to when data go to db. stamp_inserted fields are the same in one > time-bin. For what I'm asking are for example flowStartSeconds[1] and > flowEndSeconds[2]. It depends: if nfacctd_time_new is set to true then stamp_inserted does refer to when data is received at the collector; otherwise the original timestamp received from the probe, ie. flowStartSeconds, is used. Whereas stamp_updated refers to the last time a certain record is touched; the likes of flowEndSeconds are mostly ignored unless nfacctd_sql_log is set to true, ie. creation of time-bins is disabled, causing timestamps up to the second resolution to be used to populate stamp_inserted/stamp_updated fields. Lastly, hoping the probe doesn't provide more than a single time source for a certain template, nfacctd is able to use flowStartSeconds, flowStartMilliseconds or flowStartSysUpTime as indication - if multiple are defined, one is picked in a deterministic way, ie. flowStartSysUpTime wins over flowStartMilliseconds which in turns wins over flowStartSeconds. Hope this helps. > For probe we're using Juniper MX240 with JunOS 10.4R5.5 and MPC-2-3D. > pmacct from cvs, fetched month ago works flawlessly! Thanks for confirming that. Cheers, Paolo _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
