Re: ulogd - long living connections

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Tue, Jul 31, 2012 at 08:27:29PM -0700, Gomathivinayagam Muthuvinayagam wrote:
> Hi,
> 
> I feel current ulogd based accounting has some issues. It provides the
> account usage during the destroy event. This is an issue for long
> living connections, like alerting the user when he exceeds the quota.
> I read the solution from the pdf published by Herald, 2005.
> 
> Snippet is given below
> 
> To overcome limitation number one, the accounting process can use a
> combined event and polling scheme. The granularity of accounting can
> therefore be configured by the polling interval,
> and a compromise between performance and accuracy can be made.
> 
> Current ulogd2 has not yet have the functionality. The reason is,
> polling based accounting does not provide any unique id for a
> particular connection. So even if we generate polling based data and
> event based data, there is no way to combine the data. If you guys
> already thought about solution for this problem, can you share it?

You can combine that data using the hashtable that ulogd2 uses. You
only has to pass the ct object that you receive from the dump to look
for any existing matching.