Manpages

Manpage of FETCHIPAC

FETCHIPAC

Section: IPAC (8)
Updated: AUGUST 2000
Index
Return to Main Contents
 

NAME

fetchipac - read and save kernel ip accounting data  

SYNOPSIS

fetchipac  

DESCRIPTION

fetchipac is part of the ipac linux ip accounting package.

fetchipac reads the kernel ip counters and stores this information for further processing by ipacsum(8).

To do this, it first runs through a lock mechanism to prevent multiple instances of fetchipac and / or ipacset(8) to run at the same time. Then, it reads the ipac rule file, /var/run/ip-accounting-rules, so it knows what the names are for the results from the kernel. Next, it reads the kernel ip accounting data from the appropriate file in /proc/net, which is /proc/net/ip_acct if you have an ipfwadm system (kernel 2.0.*) or /proc/net/ip_fwchains if you have an ipchains system (kernel 2.1.* or newer). fetchipac opens this file in read/write mode; this makes the kernel set all counters to zero in the moment the file is opened and we can be sure to count every byte only once.

After reading and closing those files, fetchipac creates a new file in the directory /var/log/ip-acct. The file name is derived from the current system time in the format YYYYMMDD-HHMMSS. The data read is then stored in this file. The file format is simple: First, all rule names are listed, one on each line. Then, the magic delimiter "#-#-#-#-#" goes on a line on its own. Then, data lines follow; each rule has its own line, and the data comes in the same sequence as the rule names above it. Each data line has two space separated decimal numbers in the range 0 .. 2^64-1. The first number is the packet count, the second number is the byte count.  

FILES

/etc/ipac.conf
The ipac configuration file.
/var/run/ip-accounting-rules
ip accounting rule name file.
See ipacset(8) for further details.  

DIAGNOSTICS

Warning: ipac chains and/or jumps are corrupted. Trying to fix them
Some program or human deleted one of ipac's chains or jump rules. This probably means that no traffic was counted by ipac since the deletion. It may be caused by firewall set up scripts. For example, performing ipchains --flush or -F has this effect. fetchipac automatically runs ipacset --fix-chains to fix this condition. See ipacset(8), section BUGS, for details.
no ip firewall / accounting code in the kernel
The kernel had been compiled without the ip accounting feature.
many more messages
Which are meant to speak for themselves.
 

BUGS

The mechanism does not save disk space: Every time fetchipac runs, it created a new (small) file. It would be better to store the data into a database. (Which is in fact a planned project for ipac.)

Resetting accounting data counters on ipchains systems resets all counters; there is no way to reset only ipac's counters. Thus, you probably can't use other ip accounting software together which ipac on the same system.  

VERSION

This man page belongs to ipac version 1.10. For updates and other information, look at http://www.comlink.apc.org/~moritz/ipac.html  

HISTORY

fetchipac is part of ipac since the beginning. Until February 2000, it has been a shell script and was then rewritten in C.  

AUTHOR

Moritz Both <moritz@daneben.de>  

SEE ALSO

ipacset(8), ipacsum(8), ipfw(4).


 

Index

NAME
SYNOPSIS
DESCRIPTION
FILES
DIAGNOSTICS
BUGS
VERSION
HISTORY
AUTHOR
SEE ALSO

This document was created by man2html, using the manual pages.
Time: 23:24:25 GMT, March 03, 2024