[netflow-tools] softflowd -m 512000 ... flow-capture ... 90 % less traffic??
djm at mindrot.org
Thu Sep 3 18:22:07 EST 2009
On Mon, 3 Aug 2009, Andrew McGill wrote:
> ... which is great, BUT it seems that most of the traffic is getting lost.
> It's not that this traffic is getting deferred into later stats -- it simply
> never gets reported -- the reported totals dropped to 10% of their previous
> before: Average Kbits / second (real) : 49598.9333
> after: Average Kbits / second (real) : 3872.6817
> The next day it was still roughly 10% of the real amount:
> Average Kbits / second (real) : 4617.1089
> Is this correct behaviour? Am I doing one or more things wrong?
Long-running flows may live in softflowd's flow tree indefinitely
unless you specify a maxiumum lifetime (-t maxlife=N). If they don't
expire then they will not be exported and therefore won't appear in
your summarisation. 5 minutes is probably a good starting value.
More information about the netflow-tools