[netflow-tools] what happens with lost flows?

[Gijs Molenaar]

Damien Miller wrote:

> There is a small kernel-maintained input queue where some will be stored
> if flowd can't keep up, after that they are dropped, but if the system
> load is too high for something light like flowd then this will fill up
> pretty quickly.
>
> You can figure out if there have been drops by looking at
> "flow_sequence" in the FLOW_ENGINE_INFO section (obviously
> you have to direct flowd to store it).

Sorry for the late reply, I was busy with a lot of other projects.

Wouldn't it be a nice feature to be build in to flowd? For example
ipflow and flow-tools will log how many flows are dropped to
syslog. I don't exactly know how they determine this.

I understand and totally respect the minimalistic approach of the
flowd philosophy (only dump logs fast), but isn't this something
that flowd should do?


gr,

gijs