Just migrated from 1.1.8 to 1.2-rolling, running 20180621. flow accounting starts, I get some data, but then stops (randomly as far as I can tell). I can restart it, and I’ll get some data, but it eventually stops again.
show system flow-accounting
disable-imt
interface eth5
interface eth4
interface eth2
interface eth1
interface eth0
netflow {
engine-id 0
sampling-rate 64
server 192.168.X.Y {
port 9995
}
timeout {
expiry-interval 60
flow-generic 60
icmp 300
max-active-life 60
tcp-fin 60
tcp-generic 60
tcp-rst 60
udp 60
}
version 5
}
sflow {
agent-address 192.168.A.B
sampling-rate 64
server 192.168.G.H {
port 6343
}
}
syslog-facility daemon
I (very) vaguely recall having a similar problem a long time ago in 1.1, but I cannot remember, its several years ago…
Jun 25 19:04:50 vyos pmacctd[11575]: INFO ( default/core ): Linux NetFilter NFLOG Accounting Daemon, uacctd 1.6.2-git (20170401-00)
Jun 25 19:04:50 vyos pmacctd[11575]: INFO ( default/core ): Reading configuration file ‘/etc/pmacct/uacctd.conf’.
Jun 25 19:04:50 vyos pmacctd[11576]: OK ( default_memory/memory ): waiting for data on: ‘/tmp/uacctd.pipe’
The data stops being sent roughly 12-15 minutes after restart. I did install the latest image, and rebooted, but still the same behavior.
It must be crashing somehow, because:
show flow-accounting
flow-accounting is not running
Strange that there is no log at all. Another oddity is that executing “restart flow-accounting”
leaves me with this:
I would have throught that the restart would have killed the old processes, but it seems it didn’t. And indeed, a show flow-acconting immediately afterwards tells me its not running; notice that the uacctd core process and imt plugin proccess are not running, although the probes are.
I can then killall uacct, and restart flow-accounting, and then there is data again, at least for the next 12 minutes or so (am waiting now, running a tcpdump on the receiver to see when the data stops)