Hi Rajesh,
Since templates are sent out periodically (every 18th packet .. is a period :)), do you mean whether templates can be sent out on a time- based interval rather than a packet-based one? If so, currently this is not possible. The choice for each 18th packet was made originally in the softflowd code - probably a good small-enough number like anything else, i would not attach a magical sense to the number 18. The default can't be changed at the moment but exposing it via a config option would be trivial. Would a different packet-based interval work for you? My sense is that if the collector is multi-threaded and a template can land in one thread and data packets in a different one and templates are not distributed among the threads then the collector architecture is flawed (and engineering timeouts at the exporter is the wrong place to look at). But i speak without knowledge of the specific collector code, i'm just basing myself on your description. Your timeouts look good to me, i tend to recommend to set them short for better accuracy of stats - and you set them to 30 secs, which is short enough. Paolo On Tue, Apr 23, 2019 at 09:38:59PM +0530, RAJESH KUMAR S.R wrote: > Hi, > > I just need few clarifications,suggestions regarding IPFIX templates. > > 1. > Currently, just before sending the first flow packet, pmacctd seems to send > out the template packet and subsequently for every 18 packets. > We are facing the following issue: > we are using logstash(as part of ELK stack) as collector > (nfprobe_receiver), and it seems to run in multithreaded environment. > Since, the first template and flow packet is sent at the same time, they > are processed by different threads and flow packet is dropped as it doesn't > know the template. > Is there any configuration for sending template packets periodically. > 2. > Is there any particular reason for not sending template packets > periodically and sent for every 18th packet. > > 3. > Are the following timeouts a good choice for production environment. > nfprobe_timeouts: > general=30:maxlife=30:expint=30:udp=30:tcp=30:tcp.rst=30:tcp.fin=30:icmp=30 > > > > Thanks, > Rajesh kumar S R > _______________________________________________ > pmacct-discussion mailing list > http://www.pmacct.net/#mailinglists _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
