Hi all, I'm running into an issue with nfacctd where random aggregate information will be zero (specifically src and dst as, mask and net). Clearing the statistics a few minutes after starting nfacctd only temporarily eliminates the zeros. The zero entries are most obvious when using multiple aggregates, but for testing purposes I've been using one aggregate at a time to see if it was an issue with multiples. src_host, dst_host, src_port, dst_port, in_iface, and out_iface all appear to be unaffected and always contain data even when as mask and net do not.
When using src_as, src_net and src_mask together, all fields would randomly be zero. I ran tcpdump and I've been able to correlate the flows and verify that as mask and net are all being received by the host, but are for some reason not making it to the memory tables. I'm getting the following in the nfacctd.log, is this just a case of needing additional memory (only 512MB on the host)? I briefly experimented setting imt_mem_pools_number: 0 which drastically increased the number of records but still did not eliminate the zero entry. Mar 16 21:22:17 WARN ( in/memory ): Unable to allocate more memory pools, clear stats manually! Any input would be appreciated, my config is below. Thank you, Ty Bell ---nfacctd config--- daemonize: true pidfile: /var/run/nfacctd.pid logfile: /usr/local/etc/nfacctd.log nfacctd_disable_checks: true nfacctd_ip: 140.182.44.155 nfacctd_port: 2100 nfacctd_as_new: bgp nfacctd_net: bgp plugin_pipe_size: 10240000 plugin_buffer_size: 10240 bgp_daemon: true bgp_daemon_ip: 140.182.44.155 bgp_daemon_max_peers: 10 bgp_aspath_radius: 10 bgp_follow_default: 10 bgp_peer_src_as_type: bgp !bgp_daemon_msglog: true bgp_agent_map: /usr/local/etc/bgp_agent.map plugins: memory[in] !, memory[out] aggregate[in]: src_net imt_path[in]: /tmp/nfacct_in.pipe !aggregate[out]: dst_net, dst_mask, out_iface !imt_path[out]: /tmp/nfacct_out.pipe
signature.asc
Description: Message signed with OpenPGP using GPGMail
_______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
