[netflow-tools] what happens with lost flows?
gijs at looze.net
Wed Oct 5 00:29:28 EST 2005
Damien Miller wrote:
> There is a small kernel-maintained input queue where some will be stored
> if flowd can't keep up, after that they are dropped, but if the system
> load is too high for something light like flowd then this will fill up
> pretty quickly.
> You can figure out if there have been drops by looking at
> "flow_sequence" in the FLOW_ENGINE_INFO section (obviously
> you have to direct flowd to store it).
Sorry for the late reply, I was busy with a lot of other projects.
Wouldn't it be a nice feature to be build in to flowd? For example
ipflow and flow-tools will log how many flows are dropped to
syslog. I don't exactly know how they determine this.
I understand and totally respect the minimalistic approach of the
flowd philosophy (only dump logs fast), but isn't this something
that flowd should do?
More information about the netflow-tools