Hi Stig,
I tried to reproduce the issue with no joy, ie. all works good. I
suspect this might be something architecture specific - what CPU
is this?
Thing is input/output interface fields are u_int32_t and using 'i'
would get us in trouble reading from NetFlow/sFlow exporters where
interfaces have high numbering; can you test you actually get the
same issue against some other fields packed as 'I', ie. src/dst
network masks (defined as u_int8_t) and UDP/TCP ports (defined as
u_int16_t)?
Cheers,
Paolo
On Thu, Feb 20, 2014 at 03:11:16PM -0800, Stig Thormodsrud wrote:
> Hi Paolo,
>
> I've been experimenting with the new json output - nice addition. One
> thing I ran into was that the iface value was wrong. For example here's
> the csv output compared with the json output:
>
> root@ubnt-SJ:/etc/pmacct# pmacct -p /tmp/uacctd-e.pipe -s -T bytes -O csv
> TAG,IN_IFACE,OUT_IFACE,DST_IP,PACKETS,BYTES
> 7,7,15,10.1.6.191,55864,81578675
>
> root@ubnt-SJ:/etc/pmacct# pmacct -p /tmp/uacctd-e.pipe -s -T bytes -O json
> {"tag": 7, "ip_dst": "10.1.10.10", "iface_out": 36515643520, "iface_in":
> 32220676224, "packets": 59789, "bytes": 85446840}
>
> I think the problem might be that the jansson library is treating at 16 bit
> value as 64 bits. If I change it to:
>
> diff --git a/src/pmacct.c b/src/pmacct.c
> index 2fb915a..ea79788 100644
> --- a/src/pmacct.c
> +++ b/src/pmacct.c
> @@ -2929,13 +2929,13 @@ char *pmc_compose_json(u_int64_t wtc, u_int64_t
> wtc_2, u
> }
>
> if (wtc & COUNT_IN_IFACE) {
> - kv = json_pack("{sI}", "iface_in", pbase->ifindex_in);
> + kv = json_pack("{si}", "iface_in", pbase->ifindex_in);
> json_object_update_missing(obj, kv);
> json_decref(kv);
> }
>
> if (wtc & COUNT_OUT_IFACE) {
> - kv = json_pack("{sI}", "iface_out", pbase->ifindex_out);
> + kv = json_pack("{si}", "iface_out", pbase->ifindex_out);
> json_object_update_missing(obj, kv);
> json_decref(kv);
> }
>
>
> Then I get:
>
> root@ubnt-SJ:/etc/pmacct# pmacct -p /tmp/uacctd-e.pipe -s -T bytes -O json
> {"tag": 7, "ip_dst": "10.1.10.10", "iface_out": 8, "iface_in": 7,
> "packets": 119479, "bytes": 170724634}
>
> Not sure if that is the correct fix.
>
> stig
> _______________________________________________
> pmacct-discussion mailing list
> http://www.pmacct.net/#mailinglists
_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists
