Difference between revisions of "Pmacct"

Latest revision as of 21:19, 18 October 2019

This config file (location depends on your configuration but mine exists at /etc/pmacct/nfacctd.conf) makes nfacct output a json formatted dump of all flows every minute to /tmp/nfacctd.json and call /usr/local/bin/nfacct-clickhouse-import to import it into clickhouse

debug: false
daemonize: false
pidfile: /var/run/nfacctd.pid

print_cache_entries: 1000000

plugin_pipe_size: 10240000
plugin_buffer_size: 10240

plugins: print[nfacct]
aggregate [nfacct]: tcpflags,tos,proto,src_host,dst_host,src_as,dst_as,src_port,dst_port,in_iface,out_iface,peer_src_ip
print_output_file[nfacct]: /tmp/nfacctd.json
print_output[nfacct]: json
print_history[nfacct]: 1m
print_history_roundoff[nfacct]: m
print_refresh_time[nfacct]: 60
print_trigger_exec[nfacct]: /usr/local/bin/nfacct-clickhouse-import

timestamps_since_epoch: true
timestamps_secs: true

Revision as of 21:08, 18 October 2019 (view source) Timprice (talk \| contribs) ← Older edit		Latest revision as of 21:19, 18 October 2019 (view source) Timprice (talk \| contribs)
Line 1:		Line 1:
−	This config file makes nfacct output a json formatted dump of all flows every minute to /tmp/nfacctd.json and call /usr/local/bin/[[nfacct-clickhouse-import]] to import it into [[clickhouse]]	+	This config file (location depends on your configuration but mine exists at /etc/pmacct/nfacctd.conf) makes nfacct output a json formatted dump of all flows every minute to /tmp/nfacctd.json and call /usr/local/bin/[[nfacct-clickhouse-import]] to import it into [[clickhouse]]

	<pre>		<pre>