Hi Ionut, From your 'aggregate' line it seems you may be running VLANs. The filters should be slightly changed in: 'vlan and src net xx.xx.xx.xx/24' and 'vlan and src net xx.xx.xx.xx/24'. Can you give that a try? Similar if you have MPLS-labelled traffic, you would need a 'mpls and' touch.
Paolo On Fri, Nov 15, 2019 at 05:15:37PM +0200, Ionuț Bîru wrote: > Hi guys, > > I'm trying to configure sfacctd to add a tag that can help me have a clue > about the direction of the packets that I can use after to plot some graphs > using the data stored in influxb. > > I tried using pre_tag_map like in example but I cannot figure it out why it > doesn't work. > I want to ingress and egress direction. > > Did somebody managed to do that? > > /etc/pmacct/sfacctd.conf > daemonize: true > pidfile: /var/run/sfacctd.pid > syslog: daemon > interface: ens4 > sfacctd_renormalize: false > > plugins: print[print] > > pre_tag_map: /etc/pmacct/pretag.map > aggregate[print]: src_host, dst_host, src_port, dst_port, proto, vlan, > etype, tag > > print_output_file[print]: /tmp/5m_avg.json > > print_output[print]: json > print_history[print]: 5m > print_history_roundoff[print]: m > print_refresh_time[print]: 300 > #print_trigger_exec[print]: /opt/pmacct_to_influxdb.py > > /etc/pmacct/pretag.map > set_tag=1 filter='src net xx.xx.xx.xx/24' > set_tag=2 filter='dst net xx.xx.xx.xx/24' > _______________________________________________ > pmacct-discussion mailing list > http://www.pmacct.net/#mailinglists _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
