softflowd грузит проц на машине-шлюзе

apt-cache show softflowd

Description: Flow-based network traffic analyser Softflowd is a flow-based network traffic anaylser capable of Cisco Netflow data export. Softflowd semi-statefully tracks traffic flows recorded by listening on a network interface or by reading a packet capture file. These flows may be reported via NetFlow to a collecting host or summarised within softflowd itself.

По поводу формата делайте выводы

Используй ipt_netflow

можно кратко? у него такие же возможности? просто коллектор написан под формат пакетов NetFlow версии 5.

если netflow v9 не нужно - тогда ipt_netflow подойдет.
ipt_netflow это модуль ядра - поэтому нагрузка на машину с ним снизится.

скачал, собрал. завтра утром затестим модуль. ща чет неохота если че бежать на работу, шоб сервак ребутнуть, если че :)

спасиб народ! все вродя заебись.

выгружал сеня модуль, получил root 9824 0.0 0.0 5900 468 ? D 12:44 0:00 rmmod ipt_NETFLOW root 9834 0.0 0.0 5896 452 ? D 12:45 0:00 lsmod root 9894 0.0 0.0 5896 456 ? D 12:46 0:00 lsmod root 9951 0.0 0.0 5896 452 ? D 12:47 0:00 lsmod

и такое в dmesg [21707084.874369] ipt_netflow unloading.. [21707084.888196] netflow: remove destination 10.10.10.10:12345 (ffff88007f777180) [21707084.888306] ipt_netflow unloaded. [21707084.893440] kernel BUG at mm/slub.c:2929! [21707084.893440] invalid opcode: 0000 [#1] SMP [21707084.893440] last sysfs file: /sys/module/ip_tables/initstate [21707084.893440] CPU 2 [21707084.893440] Modules linked in: cls_u32 sch_sfq sch_htb ipt_set ip_set_ipmap ip_set iptable_filter iptable_mangle iptable_nat nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 xt_mark xt_conntrack nf_conntrack xt_MARK ip_tables [last unloaded: ipt_NETFLOW] [21707084.893440] Pid: 9815, comm: rmmod Not tainted 2.6.31-gentoo-r2 #2 X7DCL [21707084.893440] RIP: 0010:[<ffffffff810aeedb>] [<ffffffff810aeedb>] kfree+0x5a/0xbd [21707084.893440] RSP: 0018:ffff8800742a5e78 EFLAGS: 00010246 [21707084.893440] RAX: ffffea00007021e8 RBX: ffffffffa009be30 RCX: 0000000000400029 [21707084.893440] RDX: 0100000000020028 RSI: 0000000000000008 RDI: ffffffffa009be30 [21707084.893440] RBP: ffff8800742a5e98 R08: 0000000000000000 R09: 000000000000000a [21707084.893440] R10: 0000000000000001 R11: ffff880067531000 R12: 0000000000000007 [21707084.893440] R13: ffffffff8104df00 R14: 00007fffd4d58098 R15: 0000000000000001 [21707084.893440] FS: 00007fd87d41a6f0(0000) GS:ffff880001813000(0000) knlGS:0000000000000000 [21707084.893440] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b [21707084.893440] CR2: 00007fd87cda91c0 CR3: 000000006d362000 CR4: 00000000000006e0 [21707084.893440] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [21707084.893440] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [21707084.893440] Process rmmod (pid: 9815, threadinfo ffff8800742a4000, task ffff88000d37a7c0) [21707084.893440] Stack: [21707084.893440] ffffffffa009c460 ffffffffa0099ba8 0000000000000007 0000000000000008 [21707084.893440] <0> ffff8800742a5ec8 ffffffff8104df00 ffffffffa009c460 ffffffffa009c460 [21707084.893440] <0> 0000000000000880 0000000000000000 ffff8800742a5ee8 ffffffff81060729 [21707084.893440] Call Trace: [21707084.893440] [<ffffffff8104df00>] destroy_params+0x2a/0x3e [21707084.893440] [<ffffffff81060729>] free_module+0xb0/0x100 [21707084.893440] [<ffffffff810609bb>] sys_delete_module+0x210/0x240 [21707084.893440] [<ffffffff8118ab3d>] ? __up_write+0x42/0x47 [21707084.893440] [<ffffffff8100ba2b>] system_call_fastpath+0x16/0x1b [21707084.893440] Code: 41 ff 14 24 49 83 c4 08 49 83 3c 24 00 eb e9 48 83 fb 10 76 70 48 89 df e8 6d ed ff ff 48 8b 10 84 d2 78 15 66 f7 c2 00 c0 75 04 <0f> 0b eb fe 48 89 c7 e8 dc e1 fd ff eb 4c 48 8b 4d 08 48 8b 78 [21707084.893440] RIP [<ffffffff810aeedb>] kfree+0x5a/0xbd [21707084.893440] RSP <ffff8800742a5e78>