missing FLOWSAMPLE

[GoogleCodeExporter]

Compiled new 0.9.4 version and no more segfaults, etc. Which is great.

BUT:

- i am only getting COUNTERSSAMPLE but i am missing FLOWSAMPLE.

How do i activate nginx to send FLOWSAMPLE, cant figure it out...

Original issue reported on code.google.com by ppan...@gmail.com on 1 Jun 2011 at 6:54

[GoogleCodeExporter]

Please include your /etc/hsflowd.auto file,  and one of the counter samples (as 
printed by sflowtool).

There should be a line like this in /etc/hsflowd.auto:

sampling = <N>

or perhaps:

sampling.http = <N>

This enables 1-in-N sampling of web requests,  so if you set N to 1,  then 
every GET should result in a FLOWSAMPLE (and "sflowtool -H" should print it in 
common-logfile-format).

Did you try all this already and it still doesn't work for you?

Neil

Original comment by neil.mck...@gmail.com on 3 Jun 2011 at 5:56

• Changed state: Accepted

[GoogleCodeExporter]

adding sampling.http=1 did the trick, perhaps README should be updated to 
include it also to hsflowd.auto.

btw, is it normal that it did not give sample from the first http request, when 
doing second http request, it gives first request, etc, so it always one 
request behind.

also, not whole http useragent is not coming thru, is there possibility to get 
whole useragent also? 

Original comment by ppan...@gmail.com on 7 Jun 2011 at 12:24

[GoogleCodeExporter]

Yes,  the module is data-driven only at the moment.  I haven't figured out how 
to request a 1-second "tick" callback from the engine.  That tick would 
normally flush an sflow datagram that was not full yet, but should be sent out 
anyway.

The current draft of the sflow standard limits the useragent to 64 chars.  We 
don't want to ever fill the whole datagram with just one transaction sample so 
that's why it is chopped.  If you think it should be 128 or more then please 
raise this on the discussion group at sflow.org.

Neil

Original comment by neil.mck...@gmail.com on 8 Jun 2011 at 2:15

• Changed state: Verified