After migrating from 1.1.8, I've found that my flow accounting has stopped working correctly. Basically, flow accounting starts at boot time, but then stops roughly 10 minutes afterwards. My configuration looks like this:
show system flow-accounting disable-imt interface eth5 interface eth4 interface eth2 interface eth1 interface eth0 netflow { engine-id 0 sampling-rate 64 server 192.168.X.Y { port 9995 } timeout { expiry-interval 60 flow-generic 60 icmp 300 max-active-life 60 tcp-fin 60 tcp-generic 60 tcp-rst 60 udp 60 } version 5 } sflow { agent-address 192.168.A.B sampling-rate 64 server 192.168.G.H { port 6343 } } syslog-facility daemon
Logs show these etries:
Jun 25 19:04:50 vyos pmacctd[11575]: INFO ( default/core ): Linux NetFilter NFLOG Accounting Daemon, uacctd 1.6.2-git (20170401-00) Jun 25 19:04:50 vyos pmacctd[11575]: INFO ( default/core ): Reading configuration file ‘/etc/pmacct/uacctd.conf’. Jun 25 19:04:50 vyos pmacctd[11576]: OK ( default_memory/memory ): waiting for data on: ‘/tmp/uacctd.pipe’
Its definitely crashing, but there are no log entires at all.
It must be crashing somehow, because:
show flow-accounting flow-accounting is not running
The process table shows that the probes still seem to be running.
$ ps ax | grep uacct 11578 ? S 0:00 uacctd: Netflow Probe Plugin [default_nfprobe] 11580 ? S 0:00 uacctd: sFlow Probe Plugin [default_sfprobe]
executing restart flow-accounting then results in
$ ps ax | grep uacct 11578 ? S 0:00 uacctd: Netflow Probe Plugin [default_nfprobe] 11580 ? S 0:00 uacctd: sFlow Probe Plugin [default_sfprobe] 18538 ? S 0:00 uacctd: Netflow Probe Plugin [default_nfprobe] 18539 ? S 0:00 uacctd: sFlow Probe Plugin [default_sfprobe]
I would have throught that the restart would have killed the old processes, but it seems it didn’t. And indeed, a show flow-acconting immediately afterwards tells me its not running; notice that the uacctd core process and imt plugin proccess are not running, although the probes are.
I can then killall uacct, and restart flow-accounting, and then there is data again, at least for the next +10 minutes or so, when the process repeats itself.
I've had this since migrating, for several weeks now. My last image was installed on 20180704.