[netflow-tools] softflowd -m 512000 ... flow-capture ... 90 % less traffic??

[Damien Miller]

On Mon, 3 Aug 2009, Andrew McGill wrote:

> ... which is great, BUT it seems that most of the traffic is getting lost.  
> It's not that this traffic is getting deferred into later stats -- it simply 
> never gets reported -- the reported totals dropped to 10% of their previous 
> values!
> 
> before:  Average Kbits / second (real)   : 49598.9333
> after:   Average Kbits / second (real)   : 3872.6817
> 
> The next day it was still roughly 10% of the real amount:
> 
>     Average Kbits / second (real)   : 4617.1089
> 
> Is this correct behaviour?  Am I doing one or more things wrong?

Long-running flows may live in softflowd's flow tree indefinitely
unless you specify a maxiumum lifetime (-t maxlife=N). If they don't
expire then they will not be exported and therefore won't appear in
your summarisation. 5 minutes is probably a good starting value.

-d