Hi Joel, Are you using Juniper by any chance? I am working on an issue with Juniper IPFIX data, where the start time of the flows coming from the routers is reported weeks in the past.
Is there any way you could capture the flow data to verify the timestamp in there? Best regards Elisa On Feb 24, 2014, at 7:30 PM, Joel Krauska <[email protected]> wrote: > I'm doing mysql rollups and seeing odd timestamps. > > I'm seeing occasional stamp_inserted times in the past. > (some even as far back as several weeks) > > This is using pmacct-1.5.0rc2 > > snippet of relevant config: > > > !# Tag Map to set agent_id > pre_tag_map: pretag.map > > plugins: mysql[asn] > > sql_optimize_clauses: true > sql_refresh_time: 300 > sql_history: 5m > sql_history_roundoff: m > !sql_dont_try_update: true > > !# ASN Aggregation > aggregate[asn]: tag,dst_as,as_path,peer_dst_as > sql_table[asn]: traffic_by_asn > sql_table_type[asn]: bgp > > > My mysql schema. > CREATE TABLE `traffic_by_asn` ( > `agent_id` int(4) unsigned NOT NULL, > `as_dst` int(4) unsigned NOT NULL, > `as_path` char(21) NOT NULL, > `peer_as_dst` int(4) unsigned NOT NULL, > `packets` int(10) unsigned NOT NULL, > `bytes` bigint(20) unsigned NOT NULL, > `stamp_inserted` datetime NOT NULL, > `stamp_updated` datetime DEFAULT NULL, > PRIMARY KEY (`agent_id`,`as_dst`,`as_path`,`peer_as_dst`,`stamp_inserted`) > ) ENGINE=InnoDB DEFAULT CHARSET=latin1; > > > I assume the timestamp might be coming from the flow data? > Possibly a really old flow just now sending FINs? > > > Any advice on what this might be? > > Any way to override the flow timestamps with some actual time window data? > > Cheers, > > --Joel > > > > _______________________________________________ > pmacct-discussion mailing list > http://www.pmacct.net/#mailinglists _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
