Hello, @elbuit !
We almost ready to release rewritten flow-accounting, and maybe we will be able to include your request into it. Can you describe more detailed what exactly records you want to have? It would be good to see an example pmacct configuration for your case.

Hello @zsdc
I was also porting old style vyatta to a new one.
I've ported interface xml definition and almost finished the conf python script:

You can found them here:
https://github.com/elbuit/vyos-ports

You can find an example of how NEL format is in https://github.com/pmacct/pmacct/blob/master/QUICKSTART chapter XXI:

traffic:
aggregate[traffic]: src_host, dst_host, peer_src_ip, peer_dst_ip, in_iface, out_iface, timestamp_start, timestamp_end, src_port, dst_port, proto, tos, src_mask, dst_mask, src_as, dst_as, tcpflags
nat:
aggregate[nat]: src_host, post_nat_src_host, src_port, post_nat_src_port, proto, nat_event, timestamp_start

Basically it adds post_nat_src_host post_nat_src_port to standard flow export

Hello, @elbuit!
As I see, NAT events can be recorded only by nfacctd, and therefore this is not possible with the current way to capture traffic (by NFLOG + uacctd). Fix me, if I was missed something, please.

Hello @zsdc
I didn't tested it.

I didn't find that it doesn't work with NFLOG+uacctd anywhere
but I'll create a lab with gns3 to test if it doesn't work.
Perhaps it depends on the "hook" in iptables/nftables chain.
Give me some days to test it ;-)