Flow accounting stops after time

Just migrated from 1.1.8 to 1.2-rolling, running 20180621. flow accounting starts, I get some data, but then stops (randomly as far as I can tell). I can restart it, and I’ll get some data, but it eventually stops again.

show system flow-accounting
interface eth5
interface eth4
interface eth2
interface eth1
interface eth0
netflow {
engine-id 0
sampling-rate 64
server 192.168.X.Y {
port 9995
timeout {
expiry-interval 60
flow-generic 60
icmp 300
max-active-life 60
tcp-fin 60
tcp-generic 60
tcp-rst 60
udp 60
version 5
sflow {
agent-address 192.168.A.B
sampling-rate 64
server 192.168.G.H {
port 6343
syslog-facility daemon

I (very) vaguely recall having a similar problem a long time ago in 1.1, but I cannot remember, its several years ago…

Thanks for any tips/ideas.

any log entries on that?

Unfortunately not, just these:

Jun 25 19:04:50 vyos pmacctd[11575]: INFO ( default/core ): Linux NetFilter NFLOG Accounting Daemon, uacctd 1.6.2-git (20170401-00)
Jun 25 19:04:50 vyos pmacctd[11575]: INFO ( default/core ): Reading configuration file ‘/etc/pmacct/uacctd.conf’.
Jun 25 19:04:50 vyos pmacctd[11576]: OK ( default_memory/memory ): waiting for data on: ‘/tmp/uacctd.pipe’

The data stops being sent roughly 12-15 minutes after restart. I did install the latest image, and rebooted, but still the same behavior.

It must be crashing somehow, because:

show flow-accounting
flow-accounting is not running

Strange that there is no log at all. Another oddity is that executing “restart flow-accounting”
leaves me with this:

ps ax | grep uacct
11578 ? S 0:00 uacctd: Netflow Probe Plugin [default_nfprobe]
11580 ? S 0:00 uacctd: sFlow Probe Plugin [default_sfprobe]
18538 ? S 0:00 uacctd: Netflow Probe Plugin [default_nfprobe]
18539 ? S 0:00 uacctd: sFlow Probe Plugin [default_sfprobe]

I would have throught that the restart would have killed the old processes, but it seems it didn’t. And indeed, a show flow-acconting immediately afterwards tells me its not running; notice that the uacctd core process and imt plugin proccess are not running, although the probes are.

I can then killall uacct, and restart flow-accounting, and then there is data again, at least for the next 12 minutes or so (am waiting now, running a tcpdump on the receiver to see when the data stops)

Can you submit detailed report to phabricator.vyos.net
think that is related to changes in pmacct and likely in several places
Thanks for reporting!

I’ll open a report, but I dont have any more detail, nothing in the logs, no core dump that I could find, it just stops after about 10 minutes.