Page MenuHomePhabricator

flow-accounting stops on 1.2.0-epa2
Closed, ResolvedPublicBUG

Description

Log is showing the following error
pmacctd[3506]: ERROR ( default_nfprobe/nfprobe ): parse_engine(): engine_type:engine_id is only supported on NetFlow v5 export

I have the following config:

interface eth0
netflow {
    sampling-rate 100
    server netflow-server {
        port 2261
    }
    version 9
}
syslog-facility daemon

Details

Difficulty level
Unknown (require assessment)
Version
1.2.0-epa2
Why the issue appeared?
Will be filled on close

Event Timeline

Merijn created this task.Jan 2 2019, 9:42 PM
Merijn added a comment.Jan 2 2019, 9:44 PM

https://github.com/pmacct/pmacct/blob/master/UPGRADE

Until version 1.7.0 it was possible to (mistakenly) configure the
NetFlow v9 SourceID field/IPFIX Observation Domain ID with the old
NetFlow v5 jargon, ie. '1:1'. This is now threated as invalid and
a positive 32-bit number, ie. '100000', is expected. If exporting
NetFlow v5, nothing changed: the Engine ID/Engine Type input, ie.
'1:1', is still valid and expected.

Solved by disabling engine ID when the version is 9, not sure if this is enough but on my router it works.

--- /opt/vyatta/sbin/vyatta-netflow.pl.orig     2019-01-02 23:06:11.914045003 +0100
+++ /opt/vyatta/sbin/vyatta-netflow.pl  2019-01-02 23:04:08.951424305 +0100
@@ -173,7 +173,7 @@
         $output .= "nfprobe_receiver: $server_port\n";
         $output .= "nfprobe_version: $version\n" if defined $version;
         $output .= "nfprobe_source_ip: $source_ip\n" if defined $source_ip;
-       $output .= "nfprobe_engine: $engine_id:0\n";
+       $output .= "nfprobe_engine: $engine_id:0\n" if $version ne '9';
         $output .= "nfprobe_timeouts: $timeout_str\n"
             if $timeout_str ne '';
         $output .= "nfprobe_maxflows: $maxflows\n" if defined $maxflows;
pasik added a subscriber: pasik.Jan 3 2019, 10:22 AM
syncer changed the task status from Open to In progress.Jan 3 2019, 11:47 AM
syncer assigned this task to dmbaturin.
syncer triaged this task as High priority.
syncer edited projects, added VyOS 1.2 Crux (VyOS 1.2.0-EPA3); removed VyOS 1.2 Crux.
dmbaturin closed this task as Resolved.Jan 3 2019, 10:24 PM

Thanks!

I noticed the issue but didn't get to fixing it, applied your fix now.