From: Wanja Jansson (wanja@iamit.com)
Date: 11/21/02
Hi again,
Thank for the help the other time. Now I have a new problem:
I am doing a comparison with the sFLowSP and a nProbe, by sending
a big file (a movie on about 800MB) from one computer to mine. But
I get some very strange results. I think it has to do with the different
parameters in the configuration files. I am reading in the RFC 3176
but can still don't figure out what the parameters do.
CONFIGURATION FILE:
My configuration file looks like this: Should I change something?
What does debug=0 means? And where should I find the .txt files?
Do I need them?
ErrorLog = inxPKP.err
TraceLog = inxPKP.log
Command = inxPKP.cmd
#include "./inxGlobal.ini"
MIBInterval = 10
; ================= settings ================
PKPDevice = eth0
PKPDriverSampling = NO
PKPDeviceEnabled = YES
PKPsFlowEnabled = YES
PKPAgent = 10.1.1.15
PKPCommunity = public
PKPSamplingRate = 1000
PKPCollectorHost = 10.1.2.53
PKPMirrorDirection = both
PKPPollInterval = 45
PKPPromiscuous = YES
PKPMPRefreshTimeout = 3600
PKPMPRequestTimeout = 2
PKPMPSuppressRetryTimeout = 3600
PKPMPTableSize = 49999
PKPMPBridgeTable = bridgeTable.txt
PKPMIBIIRouteTable = routingTable.txt
PKPASInterfaceTable = ifTable.txt
PKPASPortMapping = YES
PKPASSymmetric = YES
PKPVLANTable = vlanTable.txt
; now include a config file for optionally overriding these settings
; and others below (from global.ini and inxGlobal.ini)
#includeWithNoComments "/var/sFlowSP/config/pkp.ini"
PidFile = ../pids/inxPKP.pid
debug = 0
Further below in the example logfile I havn't change anything.
LOG FILE:
What is a "good" Pollinterval? When I try e.g 60, the log file says:
20021120132335: pollCounters: WARNING: poll interval is > activeInterval
What is activeinterval?
Other lines in the log file use to look like this:
20021120003546: pollCounters: in_multicasts delta32=4294967295 TOO BIG -
not accumulating (old=91764, new=91763)
20021120003738: portLookup: concurrent SNMP requests at maximum, not
sending another
20021120084911: pollCounters: 10.1.1.15:4 out_bytes changed from 0 to
3310411095 - not accumulating
What does these different lines means? Is something wrong?
SAMPLINGRATE:
For example, the "PKPSamplingRate": when I set PKPSamplingRate = 0,
the sampling should be disabled and with PKPSamplingRate =1 all packet
should be sampled. Am I right? And in that case, what is the output I get
with PKPSamplingRate = 0 and 1?
Below are the result of one of my test of sending a movie on 814912924
bytes.
With samplingrate 0 and 1 the results are completely incorrect, Why?
With samplingrate 10, 100, 1000 and 10000 I get more or less the correct
number
of bytes IF I multilpy the total sum of bytes with the samplingrate.
Is it really supposed to be like that?
Is there anywhere some documents except from the RFC 3176 explaining these
things?
sFlow Sampling Rate = 0
Pkts Bytes
10 1814
103676 145210171
11 4244
13 1908
1 46
1 46
15 3563
41 4672
Total: 103768 145226464
sFlow Sampling Rate = 1
Pkts Bytes
10 460
14 3146
15 1419
19 3426
22 4002
5 475
99657 139634292
Total: 99742 139647220
sFlow Sampling Rate = 10
Pkts Bytes
15 720
19 5629
5 1783
58756 82773717
7 930
9 378
Total: 58811 82783157
sFlow Sampling Rate = 100
Pkts Bytes
1 46
1 46
1 46
149 216044
5677 8169439
Total: 5829 8385621
sFlow Sampling Rate = 1000
Pkts Bytes
11 16500
563 824637
Total: 574 841137
sFlow Sampling Rate = 10000
Pkts Bytes
1 1500
57 83828
Total: 58 85328
Thanks again,
Wanja
_____________________________________________
Free email with personality! Over 200 domains!
http://www.MyOwnEmail.com
This archive was generated by hypermail 2.1.4 : 11/21/02 PST