Flow accounting stops after time

netflow
vyos-1-2
pmacct
sflow

#1

Just migrated from 1.1.8 to 1.2-rolling, running 20180621. flow accounting starts, I get some data, but then stops (randomly as far as I can tell). I can restart it, and I’ll get some data, but it eventually stops again.

show system flow-accounting
disable-imt
interface eth5
interface eth4
interface eth2
interface eth1
interface eth0
netflow {
engine-id 0
sampling-rate 64
server 192.168.X.Y {
port 9995
}
timeout {
expiry-interval 60
flow-generic 60
icmp 300
max-active-life 60
tcp-fin 60
tcp-generic 60
tcp-rst 60
udp 60
}
version 5
}
sflow {
agent-address 192.168.A.B
sampling-rate 64
server 192.168.G.H {
port 6343
}
}
syslog-facility daemon

I (very) vaguely recall having a similar problem a long time ago in 1.1, but I cannot remember, its several years ago…

Thanks for any tips/ideas.


#2

any log entries on that?


#3

Unfortunately not, just these:

Jun 25 19:04:50 vyos pmacctd[11575]: INFO ( default/core ): Linux NetFilter NFLOG Accounting Daemon, uacctd 1.6.2-git (20170401-00)
Jun 25 19:04:50 vyos pmacctd[11575]: INFO ( default/core ): Reading configuration file ‘/etc/pmacct/uacctd.conf’.
Jun 25 19:04:50 vyos pmacctd[11576]: OK ( default_memory/memory ): waiting for data on: ‘/tmp/uacctd.pipe’

The data stops being sent roughly 12-15 minutes after restart. I did install the latest image, and rebooted, but still the same behavior.

It must be crashing somehow, because:

show flow-accounting
flow-accounting is not running

Strange that there is no log at all. Another oddity is that executing “restart flow-accounting”
leaves me with this:

ps ax | grep uacct
11578 ? S 0:00 uacctd: Netflow Probe Plugin [default_nfprobe]
11580 ? S 0:00 uacctd: sFlow Probe Plugin [default_sfprobe]
18538 ? S 0:00 uacctd: Netflow Probe Plugin [default_nfprobe]
18539 ? S 0:00 uacctd: sFlow Probe Plugin [default_sfprobe]

I would have throught that the restart would have killed the old processes, but it seems it didn’t. And indeed, a show flow-acconting immediately afterwards tells me its not running; notice that the uacctd core process and imt plugin proccess are not running, although the probes are.

I can then killall uacct, and restart flow-accounting, and then there is data again, at least for the next 12 minutes or so (am waiting now, running a tcpdump on the receiver to see when the data stops)


#5

Can you submit detailed report to phabricator.vyos.net
think that is related to changes in pmacct and likely in several places
Thanks for reporting!


#6

I’ll open a report, but I dont have any more detail, nothing in the logs, no core dump that I could find, it just stops after about 10 minutes.