[Netacct-mysql-users] Re: Netacct-mysql-users digest, Vol 1 #4 - 1 msg

[Nikolay H. <ge...@st...>]

> Message: 1
> Date: Tue, 26 Feb 2002 11:24:00 +0200
> From: Stoilis Giannis <st...@th...>
> To: net...@li...
> Subject: [Netacct-mysql-users] no detailled logging...
>
> Hello, I have a problem with netacct NOT logging the traffic after
> working perfectly for 2 days. My configuration:
> Ethernet Card: 3COM 905C-TX
> 3c59x: Donald Becker and others. www.scyld.com/network/vortex.html
> 02:09.0: 3Com PCI 3c905C Tornado at 0x1400. Vers LK1.1.16
>
> My networks consists of several subnets(10.0.0.x, 10.0.1.x and so on)
>
> OS: Suse Linux 7.2, custom kernel 2.4.16
>
> A router in my network forwards all traffic (0.0.0.0) to this server.
> This server does transparent proxying with squid, so ANY traffic
> destined to the internet passes right through it.
> Then, it forwards any request to my border router with the serial link
> to the internet.

i've not tested nacctd with transparent proxying but it should work ..

>
> I am using netacct-mysql-0.73rc4 with MySQL 3.23.37.
>
> More details about the problem:
> summary traffic is updated correctly.(traffic table). The accounting
> table is not updated at all or is updated with strange lines like:
> 84 10:52:41 2002-02-26 0 17 0.0.0.0 68 255.255.255.255 67 2 676 unknown
> eth0 0

i think these strange addresses are from windows machines which are doing
some broadcast requests

> I can see that the dump files has the correct entries in it when I view
> it. I can assume that it flushes it correctly since after grows to some
> kilobytes and then it empties it.
> I have raised the debug level but I could not understand exactly what to
> look for in the debug file.

dump file is for emergency purpiose .. i mean if your pc crashes .. all data
stays in dump file ..
if everything is ok .. every time when it writes to mysql it empties this
file. if you have files with .o .o.o .o.o.o
extensions it means that this data is noy written in mysql .. there is a
script in contrib dir which you can use to import this data in mysql

>
> what is more strange, is that is worked for 2 days and then just
> stopped... I even tryied completely erasing the configuration file and
> then just using the default one, changing only the subnet ip it was
> supposed to monitor.

it is very strange thing .. i see such thing for the first time .. i assume
that there is no problems with mysql server?

> here it is: (/usr/local/etc/naccttab)
>
> database mysql
> mysql_user acct
> mysql_password acct_password
> mysql_host localhost
> mysql_database netacct
> mysql_table accounting
> pidfile  /var/run/nacctd.pid
> compactnet 10.0.0.0 255.0.0.0
> flush 1
> fdelay 60
> file /var/log/net-acct
> dumpfile /var/log/net-acct-dump
> device eth0
> ignoremask 255.0.0.0

remove this line (ignoremask 255.0.0.0)

> ignorenet 127.0.0.0 255.0.0.0
> debug 2
> debugfile /tmp/nacctd.debug
> headers tr      40      38
> headers lo      14      12
> headers isdn    4       0
> headers eth     14      12
> headers plip    14      12
>
> Any ideas? Any suggestion would be most helpful...
> Thanks in advance.
>
> - Stoilis Giannis
>

Nikolay Hristov