Netflow and Sflow not working

rahuldangat · January 3, 2023, 4:42pm

HI Team,

Sflow and Netflow is not working please find below config and error logs.
vyos@RD-R1:~$ show log flow-accounting
– Journal begins at Thu 2022-12-29 03:57:19 UTC, ends at Tue 2023-01-03 16:34:24 UTC. –
Jan 03 13:59:07 systemd[1]: Starting ulog accounting daemon…
Jan 03 13:59:07 systemd[1]: uacctd.service: Can’t open PID file /run/pmacct/uacctd.pid (yet?) after start: Operation not permitted
Jan 03 13:59:07 systemd[1]: Started ulog accounting daemon.
Jan 03 13:59:08 systemd[1]: uacctd.service: Main process exited, code=killed, status=11/SEGV
Jan 03 13:59:08 systemd[1]: uacctd.service: Failed with result ‘signal’.
Jan 03 13:59:18 systemd[1]: uacctd.service: Scheduled restart job, restart counter is at 1.
Jan 03 13:59:18 systemd[1]: Stopped ulog accounting daemon.
Jan 03 13:59:18 systemd[1]: Starting ulog accounting daemon…
Jan 03 13:59:18 systemd[1]: uacctd.service: Can’t open PID file /run/pmacct/uacctd.pid (yet?) after start: Operation not permitted
Jan 03 13:59:18 systemd[1]: Started ulog accounting daemon.
Jan 03 13:59:21 systemd[1]: uacctd.service: Main process exited, code=killed, status=11/SEGV
Jan 03 13:59:21 systemd[1]: uacctd.service: Failed with result ‘signal’.
Jan 03 13:59:31 systemd[1]: uacctd.service: Scheduled restart job, restart counter is at 2.
Jan 03 13:59:31 systemd[1]: Stopped ulog accounting daemon.
Jan 03 13:59:31 systemd[1]: Starting ulog accounting daemon…
Jan 03 13:59:31 systemd[1]: uacctd.service: Can’t open PID file /run/pmacct/uacctd.pid (yet?) after start: Operation not permitted
Jan 03 13:59:31 systemd[1]: Started ulog accounting daemon.
Jan 03 13:59:41 systemd[1]: uacctd.service: Main process exited, code=killed, status=11/SEGV
Jan 03 13:59:41 systemd[1]: uacctd.service: Failed with result ‘signal’.
Jan 03 13:59:51 systemd[1]: uacctd.service: Scheduled restart job, restart counter is at 3.
Jan 03 13:59:51 systemd[1]: Stopped ulog accounting daemon.
Jan 03 13:59:51 systemd[1]: Starting ulog accounting daemon…
Jan 03 13:59:51 systemd[1]: uacctd.service: Can’t open PID file /run/pmacct/uacctd.pid (yet?) after start: Operation not permitted
Jan 03 13:59:51 systemd[1]: Started ulog accounting daemon.
Jan 03 13:59:57 systemd[1]: uacctd.service: Main process exited, code=killed, status=11/SEGV
Jan 03 13:59:57 systemd[1]: uacctd.service: Failed with result ‘signal’.
Jan 03 14:00:07 systemd[1]: uacctd.service: Scheduled restart job, restart counter is at 4.
Jan 03 14:00:07 systemd[1]: Stopped ulog accounting daemon.
Jan 03 14:00:07 systemd[1]: Starting ulog accounting daemon…
Jan 03 14:00:07 systemd[1]: uacctd.service: Can’t open PID file /run/pmacct/uacctd.pid (yet?) after start: Operation not permitted
Jan 03 14:00:07 systemd[1]: Started ulog accounting daemon.
Jan 03 14:00:21 systemd[1]: uacctd.service: Main process exited, code=killed, status=11/SEGV
Jan 03 14:00:21 systemd[1]: uacctd.service: Failed with result ‘signal’.
Jan 03 14:00:31 systemd[1]: uacctd.service: Scheduled restart job, restart counter is at 5.
Jan 03 14:00:31 systemd[1]: Stopped ulog accounting daemon.
Jan 03 14:00:31 systemd[1]: Starting ulog accounting daemon…
Jan 03 14:00:31 systemd[1]: uacctd.service: Can’t open PID file /run/pmacct/uacctd.pid (yet?) after start: Operation not permitted
Jan 03 14:00:31 systemd[1]: Started ulog accounting daemon.
Jan 03 14:00:53 systemd[1]: uacctd.service: Main process exited, code=killed, status=11/SEGV
Jan 03 14:00:53 systemd[1]: uacctd.service: Failed with result ‘signal’.
Jan 03 14:01:03 systemd[1]: uacctd.service: Scheduled restart job, restart counter is at 6.
Jan 03 14:01:03 systemd[1]: Stopped ulog accounting daemon.
Jan 03 14:01:03 systemd[1]: Starting ulog accounting daemon…
Jan 03 14:01:03 systemd[1]: uacctd.service: Can’t open PID file /run/pmacct/uacctd.pid (yet?) after start: Operation not permitted
Jan 03 14:01:03 systemd[1]: Started ulog accounting daemon.
Jan 03 14:01:41 systemd[1]: uacctd.service: Main process exited, code=killed, status=11/SEGV
Jan 03 14:01:41 systemd[1]: uacctd.service: Failed with result ‘signal’.
Jan 03 14:01:51 systemd[1]: uacctd.service: Scheduled restart job, restart counter is at 7.
Jan 03 14:01:51 systemd[1]: Stopped ulog accounting daemon.
Jan 03 14:01:51 systemd[1]: Starting ulog accounting daemon…
Jan 03 14:01:51 systemd[1]: uacctd.service: Can’t open PID file /run/pmacct/uacctd.pid (yet?) after start: Operation not permitted
Jan 03 14:01:51 systemd[1]: Started ulog accounting daemon.
Jan 03 14:02:10 systemd[1]: uacctd.service: Main process exited, code=killed, status=11/SEGV
Jan 03 14:02:10 systemd[1]: uacctd.service: Failed with result ‘signal’.
Jan 03 14:02:20 systemd[1]: uacctd.service: Scheduled restart job, restart counter is at 8.
Jan 03 14:02:20 systemd[1]: Stopped ulog accounting daemon.
Jan 03 14:02:20 systemd[1]: Starting ulog accounting daemon…
Jan 03 14:02:20 systemd[1]: uacctd.service: Can’t open PID file /run/pmacct/uacctd.pid (yet?) after start: Operation not permitted
Jan 03 14:02:20 systemd[1]: Started ulog accounting daemon.
Jan 03 14:02:45 systemd[1]: uacctd.service: Main process exited, code=killed, status=11/SEGV
Jan 03 14:02:45 systemd[1]: uacctd.service: Failed with result ‘signal’.
Jan 03 14:02:55 systemd[1]: uacctd.service: Scheduled restart job, restart counter is at 9.
Jan 03 14:02:55 systemd[1]: Stopped ulog accounting daemon.
Jan 03 14:02:55 systemd[1]: Starting ulog accounting daemon…
Jan 03 14:02:55 systemd[1]: uacctd.service: Can’t open PID file /run/pmacct/uacctd.pid (yet?) after start: Operation not permitted
Jan 03 14:02:55 systemd[1]: Started ulog accounting daemon.
Jan 03 14:03:49 systemd[1]: uacctd.service: Main process exited, code=killed, status=11/SEGV
Jan 03 14:03:49 systemd[1]: uacctd.service: Failed with result ‘signal’.
Jan 03 14:03:59 systemd[1]: uacctd.service: Scheduled restart job, restart counter is at 10.
Jan 03 14:03:59 systemd[1]: Stopped ulog accounting daemon.
Jan 03 14:03:59 systemd[1]: Starting ulog accounting daemon…
Jan 03 14:03:59 systemd[1]: uacctd.service: Can’t open PID file /run/pmacct/uacctd.pid (yet?) after start: Operation not permitted
Jan 03 14:03:59 systemd[1]: Started ulog accounting daemon.
Jan 03 14:04:53 systemd[1]: uacctd.service: Main process exited, code=killed, status=11/SEGV
Jan 03 14:04:53 systemd[1]: uacctd.service: Failed with result ‘signal’.
Jan 03 14:05:03 systemd[1]: uacctd.service: Scheduled restart job, restart counter is at 11.
Jan 03 14:05:03 systemd[1]: Stopped ulog accounting daemon.
Jan 03 14:05:03 systemd[1]: Starting ulog accounting daemon…
Jan 03 14:05:03 systemd[1]: uacctd.service: Can’t open PID file /run/pmacct/uacctd.pid (yet?) after start: Operation not permitted
Jan 03 14:05:03 systemd[1]: Started ulog accounting daemon.
Jan 03 14:05:03 systemd[1]: uacctd.service: Main process exited, code=killed, status=11/SEGV
Jan 03 14:05:03 systemd[1]: uacctd.service: Failed with result ‘signal’.
Jan 03 14:05:14 systemd[1]: uacctd.service: Scheduled restart job, restart counter is at 12.
Jan 03 14:05:14 systemd[1]: Stopped ulog accounting daemon.
Jan 03 14:05:14 systemd[1]: Starting ulog accounting daemon…
Jan 03 14:05:14 systemd[1]: uacctd.service: Can’t open PID file /run/pmacct/uacctd.pid (yet?) after start: Operation not permitted
Jan 03 14:05:14 systemd[1]: Started ulog accounting daemon.
Jan 03 14:05:57 systemd[1]: uacctd.service: Main process exited, code=killed, status=11/SEGV
Jan 03 14:05:57 systemd[1]: uacctd.service: Failed with result ‘signal’.
Jan 03 14:06:07 systemd[1]: uacctd.service: Scheduled restart job, restart counter is at 13.
Jan 03 14:06:07 systemd[1]: Stopped ulog accounting daemon.
Jan 03 14:06:07 systemd[1]: Starting ulog accounting daemon…
Jan 03 14:06:07 systemd[1]: uacctd.service: Can’t open PID file /run/pmacct/uacctd.pid (yet?) after start: Operation not permitted
Jan 03 14:06:07 systemd[1]: Started ulog accounting daemon.
Jan 03 14:07:01 systemd[1]: uacctd.service: Main process exited, code=killed, status=11/SEGV
Jan 03 14:07:01 systemd[1]: uacctd.service: Failed with result ‘signal’.
Jan 03 14:07:11 systemd[1]: uacctd.service: Scheduled restart job, restart counter is at 14.
Jan 03 14:07:11 systemd[1]: Stopped ulog accounting daemon.
Jan 03 14:07:11 systemd[1]: Starting ulog accounting daemon…
Jan 03 14:07:11 systemd[1]: uacctd.service: Can’t open PID file /run/pmacct/uacctd.pid (yet?) after start: Operation not permitted
Jan 03 14:07:11 systemd[1]: Started ulog accounting daemon.
Jan 03 14:08:05 systemd[1]: uacctd.service: Main process exited, code=killed, status=11/SEGV
Jan 03 14:08:05 systemd[1]: uacctd.service: Failed with result ‘signal’.
Jan 03 14:08:15 systemd[1]: uacctd.service: Scheduled restart job, restart counter is at 15.
Jan 03 14:08:15 systemd[1]: Stopped ulog accounting daemon.
Jan 03 14:08:15 systemd[1]: Starting ulog accounting daemon…
Jan 03 14:08:15 systemd[1]: uacctd.service: Can’t open PID file /run/pmacct/uacctd.pid (yet?) after start: Operation not permitted
Jan 03 14:08:15 systemd[1]: Started ulog accounting daemon.
Jan 03 14:09:09 systemd[1]: uacctd.service: Main process exited, code=killed, status=11/SEGV
Jan 03 14:09:09 systemd[1]: uacctd.service: Failed with result ‘signal’.
Jan 03 14:09:19 systemd[1]: uacctd.service: Scheduled restart job, restart counter is at 16.
Jan 03 14:09:19 systemd[1]: Stopped ulog accounting daemon.
Jan 03 14:09:19 systemd[1]: Starting ulog accounting daemon…
Jan 03 14:09:19 systemd[1]: uacctd.service: Can’t open PID file /run/pmacct/uacctd.pid (yet?) after start: Operation not permitted
Jan 03 14:09:19 systemd[1]: Started ulog accounting daemon.
Jan 03 14:10:04 systemd[1]: uacctd.service: Main process exited, code=killed, status=11/SEGV
Jan 03 14:10:04 systemd[1]: uacctd.service: Failed with result ‘signal’.
Jan 03 14:10:14 systemd[1]: uacctd.service: Scheduled restart job, restart counter is at 17.
Jan 03 14:10:14 systemd[1]: Stopped ulog accounting daemon.
Jan 03 14:10:14 systemd[1]: Starting ulog accounting daemon…
Jan 03 14:10:14 systemd[1]: uacctd.service: Can’t open PID file /run/pmacct/uacctd.pid (yet?) after start: Operation not permitted
Jan 03 14:10:14 systemd[1]: Started ulog accounting daemon.
Jan 03 14:11:17 systemd[1]: uacctd.service: Main process exited, code=killed, status=11/SEGV
Jan 03 14:11:17 systemd[1]: uacctd.service: Failed with result ‘signal’.
Jan 03 14:11:27 systemd[1]: uacctd.service: Scheduled restart job, restart counter is at 18.
Jan 03 14:11:27 systemd[1]: Stopped ulog accounting daemon.
Jan 03 14:11:27 systemd[1]: Starting ulog accounting daemon…
Jan 03 14:11:27 systemd[1]: uacctd.service: Can’t open PID file /run/pmacct/uacctd.pid (yet?) after start: Operation not permitted
Jan 03 14:11:27 systemd[1]: Started ulog accounting daemon.
Jan 03 14:12:21 systemd[1]: uacctd.service: Main process exited, code=killed, status=11/SEGV
Jan 03 14:12:21 systemd[1]: uacctd.service: Failed with result ‘signal’.
Jan 03 14:12:31 systemd[1]: uacctd.service: Scheduled restart job, restart counter is at 19.
Jan 03 14:12:31 systemd[1]: Stopped ulog accounting daemon.
Jan 03 14:12:31 systemd[1]: Starting ulog accounting daemon…
Jan 03 14:12:31 systemd[1]: uacctd.service: Can’t open PID file /run/pmacct/uacctd.pid (yet?) after start: Operation not permitted
Jan 03 14:12:31 systemd[1]: Started ulog accounting daemon.
Jan 03 14:13:25 systemd[1]: uacctd.service: Main process exited, code=killed, status=11/SEGV
Jan 03 14:13:25 systemd[1]: uacctd.service: Failed with result ‘signal’.
Jan 03 14:13:35 systemd[1]: uacctd.service: Scheduled restart job, restart counter is at 20.
Jan 03 14:13:35 systemd[1]: Stopped ulog accounting daemon.
Jan 03 14:13:35 systemd[1]: Starting ulog accounting daemon…
Jan 03 14:13:35 systemd[1]: uacctd.service: Can’t open PID file /run/pmacct/uacctd.pid (yet?) after start: Operation not permitted
Jan 03 14:13:35 systemd[1]: Started ulog accounting daemon.

Config===
flow-accounting {
enable-egress
interface eth0
interface lo
netflow {
engine-id 101
sampling-rate 1
server 172.18.61.88 {
}
source-address 172.18.61.101
version 9
}
sflow {
agent-address 172.18.61.101
sampling-rate 1
server 172.18.61.85 {
}
server 172.18.61.88 {
}

Viacheslav · January 3, 2023, 4:46pm

Which version? show version

rahuldangat · January 3, 2023, 4:50pm

vyos@RD-R1:~$ show version
Version: VyOS 1.4-rolling-202212280917
Release train: current

Built by: autobuild@vyos.net
Built on: Wed 28 Dec 2022 09:17 UTC
Build UUID: e5312f1b-3eaf-4537-b155-7653b874e80e
Build commit ID: 0351b37359517d

Architecture: x86_64
Boot via: installed image
System type: KVM guest

Hardware vendor: QEMU
Hardware model: Standard PC (i440FX + PIIX, 1996)
Hardware S/N:
Hardware UUID: 2dd8004c-56e0-44d5-87fe-5cafa6f5e376

Copyright: VyOS maintainers and contributors

rahuldangat · January 3, 2023, 4:58pm

Also please find logs which process got crush

vyos@RD-R1:~$ show flow-accounting interface eth0
IN_IFACE SRC_MAC DST_MAC SRC_IP DST_IP SRC_PORT DST_PORT PROTOCOL TOS PACKETS FLOWS BYTES

eth0 00:b7:71:2e:46:d7 01:00:5e:00:00:05 172.18.61.65 224.0.0.5 0 0 ospf 192 2 1 128
eth0 00:b7:71:2e:46:d7 96:1b:08:37:0f:db 10.252.10.104 172.18.61.101 63411 22 tcp 0 91 1 6136
vyos@RD-R1:~$ show flow-accounting interface eth0
flow-accounting is not active
vyos@RD-R1:~$
vyos@RD-R1:~$
vyos@RD-R1:~$ show flow-accounting interface eth0
flow-accounting is not active
vyos@RD-R1:~$ show flow-accounting interface eth0
flow-accounting is not active
vyos@RD-R1:~$ show flow-accounting interface eth0
flow-accounting is not active
vyos@RD-R1:~$

rahuldangat · January 3, 2023, 5:14pm

Adding additional logs
root@RD-R1:~# sudo service uacctd status
● uacctd.service - ulog accounting daemon
Loaded: loaded (/lib/systemd/system/uacctd.service; disabled; vendor preset: enabled)
Drop-In: /etc/systemd/system/uacctd.service.d
└─override.conf
Active: active (running) since Tue 2023-01-03 17:12:48 UTC; 52s ago
Process: 10946 ExecStart=/usr/sbin/uacctd -f /run/pmacct/uacctd.conf (code=exited, status=0/SUCCESS)
Main PID: 10947 (uacctd)
Tasks: 4 (limit: 4688)
Memory: 45.4M
CPU: 66ms
CGroup: /system.slice/uacctd.service
├─10947 uacctd: Core Process [default]
├─10948 uacctd: Netflow Probe Plugin [nf_172-18-61-107]
├─10949 uacctd: sFlow Probe Plugin [sf_172-18-61-107]
└─10950 uacctd: IMT Plugin [default_memory]

Jan 03 17:12:48 RD-R1 systemd[1]: Starting ulog accounting daemon…
Jan 03 17:12:48 RD-R1 systemd[1]: uacctd.service: Can’t open PID file /run/pmacct/uacctd.pid (yet?) after start: Operation not permitted
Jan 03 17:12:48 RD-R1 systemd[1]: Started ulog accounting daemon.

janholtz · September 2, 2023, 2:15pm

Here’s an ugly hack that seems to work:

vi /lib/systemd/system/uacctd.service

ExecStartPost=/bin/bash -c ‘/bin/systemctl show -p MainPID --value uacctd’ > /run/pmacct/uacctd.pid

syncer · September 2, 2023, 10:28pm

that is too old
you need to update to the latest rolling first