[netflow-tools] what happens with lost flows?

[Damien Miller]

Gijs Molenaar wrote:
> Hello,
> 
> What will happen when the system load is very high, and flowd can't 
> process incomming flows? will these flows be dropped? If they are 
> dropped, is there a way to discover how many flows are dropped?

There is a small kernel-maintained input queue where some will be stored
if flowd can't keep up, after that they are dropped, but if the system
load is too high for something light like flowd then this will fill up
pretty quickly.

You can figure out if there have been drops by looking at
"flow_sequence" in the FLOW_ENGINE_INFO section (obviously
you have to direct flowd to store it).

-d