After migrating from 1.1.8, I've found that my flow accounting has stopped working correctly. Basically, flow accounting starts at boot time, but then stops roughly 10 minutes afterwards. My configuration looks like this:
show system flow-accounting
disable-imt
interface eth5
interface eth4
interface eth2
interface eth1
interface eth0
netflow {
engine-id 0
sampling-rate 64
server 192.168.X.Y {
port 9995
}
timeout {
expiry-interval 60
flow-generic 60
icmp 300
max-active-life 60
tcp-fin 60
tcp-generic 60
tcp-rst 60
udp 60
}
version 5
}
sflow {
agent-address 192.168.A.B
sampling-rate 64
server 192.168.G.H {
port 6343
}
}
syslog-facility daemon
Logs show these etries:
Jun 25 19:04:50 vyos pmacctd[11575]: INFO ( default/core ): Linux NetFilter NFLOG Accounting Daemon, uacctd 1.6.2-git (20170401-00)
Jun 25 19:04:50 vyos pmacctd[11575]: INFO ( default/core ): Reading configuration file ‘/etc/pmacct/uacctd.conf’.
Jun 25 19:04:50 vyos pmacctd[11576]: OK ( default_memory/memory ): waiting for data on: ‘/tmp/uacctd.pipe’
Its definitely crashing, but there are no log entires at all.
It must be crashing somehow, because:
show flow-accounting
flow-accounting is not running
The process table shows that the probes still seem to be running.
ps ax | grep uacct
11578 ? S 0:00 uacctd: Netflow Probe Plugin [default_nfprobe]
11580 ? S 0:00 uacctd: sFlow Probe Plugin [default_sfprobe]
executing restart flow-accounting then results in
ps ax | grep uacct
11578 ? S 0:00 uacctd: Netflow Probe Plugin [default_nfprobe]
11580 ? S 0:00 uacctd: sFlow Probe Plugin [default_sfprobe]
18538 ? S 0:00 uacctd: Netflow Probe Plugin [default_nfprobe]
18539 ? S 0:00 uacctd: sFlow Probe Plugin [default_sfprobe]
I would have throught that the restart would have killed the old processes, but it seems it didn’t. And indeed, a show flow-acconting immediately afterwards tells me its not running; notice that the uacctd core process and imt plugin proccess are not running, although the probes are.
I can then killall uacct, and restart flow-accounting, and then there is data again, at least for the next +10 minutes or so, when the process repeats itself.
I've had this since migrating, for several weeks now. My last image was installed on 20180704.