[Netacct-mysql-users] FYI: IP accounting with Linux/netfilter/ULOG

[Hilko B. <be...@vd...>]

ulog-acctd is a userspace network accounting daemon which generates
log files of network traffic for accounting purposes. Its output
format cen be configured via a format string, therefore it's possible
to have it look similar to that of net-acct.

I had originally hacked net-acctd for my employer (an ISP that uses
Linux for some core routers) to use the Linux 2.2 packet interface
(packet(7)) instead of the now obsolete Linux 2.0 interface (ip(7)),
but we found out that a significant number of packets were not
accounted under high network load, so we abandoned that approach. 

We suspect that the "old" net-acct (and also net-acct-mysql) share
this problem.

As the name suggests, ulog-acctd uses the ULOG netfilter target that
is provided with newer Linux 2.4 kernels. This means that ulog-acctd
can only see those packets that are handled by netfilter. Packets that
merely travel through the same ethernet segment are not handled.

Because selection of packets that are to be accounted can be done in
kernel space via iptables(8), ulog-acctd does not need code for that
and thus does not do much more than the actual aggregation and logging
of accounting information.

You can get ulog-acctd from
http://savannah.nongnu.org/download/ulog-acctd/.

-Hilko