Hi Paolo, Thanks for your answer.
We are currently using the same sampling rate for all our Netflow sources so I will look for ways to process the data before passing it in the tee plugin. Alexandre Le 05/09/2019 à 00:20, Paolo Lucente a écrit : > Hi Alexandre, > > Renormalization is a feature available only with collection (not teeing, > since teeing does no or very minimal parsing). I am curious, are you using > some sort of variable sampling rate or is it a constant? Perhaps you see > where i am going to - if constant, you could perhaps factor it in at > some point in your post processing. > > Paolo > > On Wed, Sep 04, 2019 at 04:41:15PM +0200, alexandre wrote: >> Hello, >> >> We are currently using exporting Netflow data to multiple Netflow >> collectors using the tee plugin along with nfacctd. The problem is that >> we are sampling our flows, and some collectors don't offer the >> possibility to correct the values. >> >> I saw that nfacctd had some parameters that could correct the data (like >> renormalize) and I would like to use it to correct my sampled Netflow >> before exporting it with the tee plugin, but I still get the sampled >> values. >> >> We are using Netflow v9 and the sampling value is not sent by the router. >> >> Here is an example of the .conf file I use for nfacctd : >> >> nfacctd_port: 2100 >> nfacctd_ip: 0.0.0.0 >> nfacctd_renormalize: true >> nfacctd_ext_sampling_rate: 1024 >> ! >> plugins: tee[br01] >> tee_receivers[br01]: /var/pmacct/tee_br01.lst >> ! >> !pre_tag_map: /path/to/pretag.map >> ! >> plugin_buffer_size: 10240 >> plugin_pipe_size: 1024000 >> nfacctd_pipe_size: 1024000 >> >> Do you have any suggestion about it ? >> >> Many thanks >> >> >> _______________________________________________ >> pmacct-discussion mailing list >> http://www.pmacct.net/#mailinglists > _______________________________________________ > pmacct-discussion mailing list > http://www.pmacct.net/#mailinglists
_______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
