Wednesday, April 29, 2020

Pmacct buffer size

Hi I'm testing pmacct in small network and it works just fine. But when i test it in my real network(with over 400 clients)it doesn't work completly fine. In my real network it should prints data to my database every 60 seconds but it prints data only when i close nfacctd. Here is my config file

debug: true ! for this example, I wan to run nfacctd by hand and look at the output daemonize: false pidfile: /var/run/nfacctd.pid ! remember to configure logrotate if you use logfile !logfile : /var/log/nfacct.log

! returns warning messages in case of data loss ! bufferization of data transfers between core process and active plugins (default 4MB) plugin_pipe_size: 102400000

! The value has to be <= the size defined by 'plugin_pipe_size' and keeping a ratio < 1:1000 between the two ! Once a buffer is filled, it is delivered to the plugin plugin_buffer_size: 102400

! automatically renormalizes byte/packet counters value basing on information acquired ! and take count of the sampling_rate in the (s)Flow sample nfacctd_renormalize: true

nfacctd_pipe_size: 1024000

plugins: memory[m], print[print] ! check primitives list in CONFIG-KEYS aggregate[m]: src_host, dst_host, src_port, dst_port, proto, tos, etype

aggregate [print]: src_host, dst_host, src_port, dst_port, proto, tos, etype

! by default file is overwritten print_output_file[print]: /opt/1m.json print_output[print]: json print_history[print]: 60s print_history_roundoff[print]: m print_refresh_time[print]: 60 ! we want to run this script after purging cache (but that's another story) : print_trigger_exec[print]: /opt/pm2influx.sh

I think maybe buffer size is the problem.

Please help! Thanks



No comments:

Post a Comment