search

repeatedly / fluent-plugin-netflow

Netflow plugin for Fluentd
60 stars 24 forks source link

Support Cisco IOS-XR netflow v9 mpls ipv4-ipv6-field mode #5

Closed junpei-yoshino closed 9 years ago

junpei-yoshino commented 9 years ago

In IOS-XR with below config, there are some error logs.

flow monitor-map hoge
   record mpls ipv4-ipv6-fields labels 3

There are 2 reasons. [1] unsupport fields

[2] scope field is not supported

repeatedly commented 9 years ago

Commented. Patch itself is good :+1:

junpei-yoshino commented 9 years ago

Thank you for your review. I renamed "scopefields" to "scope_fields".

junpei-yoshino commented 9 years ago

I'm testing now. In my enviroment, Cisco router seems to not match rfc 3954. Please wait a merge for fix.

junpei-yoshino commented 9 years ago

I modified option field definition yaml file. There are some difference from rfc3954. I rewrite field type 31 and 48.

I think that is not best way. Netflow exporter's implementation will be keep changing. I recommend to define ":uint" symbol. It's variable length unsigned integer. length is defined by template.

If we reach a consensus, I replace here. https://github.com/repeatedly/fluent-plugin-netflow/blob/master/lib/fluent/plugin/parser_netflow.rb#L212-L223

junpei-yoshino commented 9 years ago

I'll make new PullRequest about using :uint symbol. This branch works well.

repeatedly commented 9 years ago

Thanks for hard work! Just merged this patch.

junpei-yoshino commented 9 years ago

Thank you for merge!