uacctd don't log trafic about pmacct

[pzelektron]

I work for ISP we must to log traffic from our customers.
I tried to use pmacct but i/o was very high on postgres server. 8 cores CPU and load over 80%.
After switching on nfacctd load drop to 1%

[paololucente]

Hi @pzelektron , in the log output above QN: 0/0 means that the plugin is trying to write zero tuples to the database -- so it is expected the DB to be empty because uacctd is not writing any tuples into it. We should make sure that uacctd is actually receiving traffic: what do you see if you run a tcpdump -s 0 -n -i nflog:5 ? Paolo

[pzelektron]

Thanks for help this :
tcpdump -s 0 -n -i nflog:5
was very helpful.
It shows my mistake in iptables. I used:
iptables -I FORWARD ! -i eth0 -m state --state NEW -p tcp -j NFLOG --nflog-prefix 5
but it should be :
iptables -I FORWARD ! -i eth0 -m state --state NEW -p tcp -j NFLOG --nflog-group 5
Now everything works great.
Thanks again.

[paololucente]

Amazing, thanks for confirming! Paolo