Comments (7)
Hi @danyrlz ,
Thanks for reporting this!
Can you please remove one moment the pre_tag_label_filter
to observe what happens? Is all traffic labelled as other
? Or what happens? It may also help if you could send me a sample of a sFlow packet, especially to test the direction
part of matching / non-matching.
Paolo
from pmacct.
Hello,
it looks like there is more fundamental issue as we get the same without the "direction" key:
.....
pre_tag_label_filter[bgp2]: ing
.....
set_label=ing ip=0.0.0.0/0 label=ing jeq=src
#
# START_SRC-Static
set_tag=xxxx ip=0.0.0.0/0 src_mac=xx:xx:xx:xx:xx:xx label=src jeq=dst
# START_DST-Static
set_tag2=xxxx ip=0.0.0.0/0 dst_mac=yy:yy:yy:yy:yy:yy label=dst
RESULT:
2023-12-14T07:25:01Z INFO ( bgp2/print ): *** Purging cache - START (PID: 82609) ***
2023-12-14T07:25:01Z INFO ( bgp2/print ): *** Purging cache - END (PID: 82609, QN: 0/0, ET: X) ***
Here is with disabled filter:
.....
pre_tag_label_filter[mac2]: -null
#pre_tag_label_filter[bgp2]: ing
.....
set_label=ing ip=0.0.0.0/0 label=ing jeq=src
#
# START_SRC-Static
set_tag=xxxx ip=0.0.0.0/0 src_mac=xx:xx:xx:xx:xx:xx label=src jeq=dst
# START_DST-Static
set_tag2=xxxx ip=0.0.0.0/0 dst_mac=yy:yy:yy:yy:yy:yy label=dst
RESULT:
2023-12-14T07:30:01Z INFO ( mac2/print ): *** Purging cache - START (PID: 82721) ***
2023-12-14T07:30:01Z INFO ( bgp2/print ): *** Purging cache - START (PID: 82722) ***
2023-12-14T07:30:01Z INFO ( mac2/print ): *** Purging cache - END (PID: 82721, QN: 6779/6779, ET: 0) ***
2023-12-14T07:30:03Z INFO ( bgp2/print ): *** Purging cache - END (PID: 82722, QN: 634790/634790, ET: 2) ***
from pmacct.
Hi Jordan ( @danyrlz ),
I should have been able to reproduce the issue and fix it. Can you give a try to latest code and confirm whether it works for you?
Paolo
from pmacct.
Hello again,
It seems to work now but we get another error with the same config from 1.7.8:
2023-12-15T11:30:46Z INFO ( default/core ): [/etc/pmacct/pretag/peer5b.map] (re)loading map.
2023-12-15T11:30:46Z INFO ( bgp2/print ): cache entries=5000000 base cache memory=17160000000 bytes
2023-12-15T11:30:46Z INFO ( default/core ): [/etc/pmacct/pretag/peer5b.map] map successfully (re)loaded.
2023-12-15T11:30:46Z INFO ( default/core ): [/etc/pmacct/pretag/peer5b.map] (re)loading map.
2023-12-15T11:30:46Z WARN ( default/core ): [/etc/pmacct/pretag/peer5b.map] Unresolved label 'dst'. Ignoring it.
2023-12-15T11:30:46Z WARN ( default/core ): [/etc/pmacct/pretag/peer5b.map] Unresolved label 'dst'. Ignoring it.
2023-12-15T11:30:46Z WARN ( default/core ): [/etc/pmacct/pretag/peer5b.map] Unresolved label 'dst'. Ignoring it.
2023-12-15T11:30:46Z WARN ( default/core ): [/etc/pmacct/pretag/peer5b.map] Unresolved label 'dst'. Ignoring it.
2023-12-15T11:30:46Z WARN ( default/core ): [/etc/pmacct/pretag/peer5b.map] Unresolved label 'dst'. Ignoring it.
2023-12-15T11:30:46Z WARN ( default/core ): [/etc/pmacct/pretag/peer5b.map] Unresolved label 'dst'. Ignoring it.
2023-12-15T11:30:46Z WARN ( default/core ): [/etc/pmacct/pretag/peer5b.map] Unresolved label 'dst'. Ignoring it.
2023-12-15T11:30:46Z WARN ( default/core ): [/etc/pmacct/pretag/peer5b.map] Unresolved label 'dst'. Ignoring it.
2023-12-15T11:30:46Z WARN ( default/core ): [/etc/pmacct/pretag/peer5b.map] Unresolved label 'dst'. Ignoring it.
We use the same pretag map structure like above. When we use just few lines in the new version it looks ok but when we load the full map(around 500 lines) we get the error.
Is there any limitation or anything new specific here?
from pmacct.
Hello Paolo @paololucente,
It looks like when we have more than 52 lines with "jeq=dst" statement the problem above is present.
from pmacct.
Hi Jordan @danyrlz , sorry the silence, i was working on some code -- having been able to reproduce your issue. I have some code ready & testing at the moment. I should have news by the end of the day. Paolo
from pmacct.
Hi Jordan @danyrlz , the last commit ( 547e241 ) should address your remaining issue -- can you give it a try and let me know if all looks to work as expected?
Paolo
from pmacct.
Related Issues (20)
- MYSQL / PGSQL / SQLite missing v9 table reference and SQLite documentation fix HOT 6
- sampling_direction aggregation breaks sFlow accounting HOT 6
- Building pmacct 1.7.8 with nDPI 4.6-stable failing HOT 10
- IPFIX & nano seconds timestamps HOT 4
- Sample configuration for pmbmp writing into a kafka HOT 1
- Triggered processes by print module being infinitely leaved in zombie state HOT 4
- uacctd don't log trafic HOT 4
- Question | Application ID having length of 4. HOT 3
- Question: nfacctd storage HOT 9
- Sampling directive broken HOT 2
- Create pipeline to add information to PMACCT flows HOT 1
- Trouble writing data to database HOT 11
- Add IPv6 support to Proxy Protocol Header parsing HOT 4
- Compile failure on Oracle Linux 9 HOT 6
- nfacctd_templates_receiver container Operation not permitted HOT 3
- Openwrt: compile error for [-Werror=stringop-overflow=] in src/external_libs/libcdada/include/cdada/__list_internal.h HOT 8
- Adding timestamp to stderr logging HOT 7
- Telemetry daemon silently stops when incorrect messages sent to listening port HOT 1
- nfacctd: NetFlow v9 / IPFIX, correlate Options data to Flow data (ie. VRF ID -> VRF Name) HOT 3
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from pmacct.