1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
|
This document doesn't replace documentation relevant to the database software you are
using, ie. README.mysql, README.pgsql or README.sqlite3.
The 'timestamp_start', 'timestamp_end', 'timestamp_arrival', 'timestamp_min' and
'timestamp_max' fields.
'timestamp_start' and 'timestamp_end' fields are being introduced to support logging
of traffic and events via pmacct (mainly NetFlow/IPFIX feature). 'timestamp_arrival'
records libpcap packet timestamp and sFlow/NetFlow/IPFIX packet arrival time at the
collector; 'timestamp_min' and 'timestamp_max' fields support stitching of flows (or
samples if sfacctd or packets if pmacctd), for more info see nfacctd_stitching feature
in CONFIG-KEYS.
Timestamps resolution is up to the msec level and for this reason time residual fields
are optionally introduced ie. 'timestamp_start_residual', 'timestamp_end_residual':
this is because support for resolutions beyond the secs level is something not popular
among the supported RDBMS, ie. only recent versions of MySQL >= 5.6.4 appear to support
it, hence the choice to go for two separate fields. Timestamp resolution can be cut
to secs level by setting timestamps_secs config directive to 'true': in this case the
residual fields can be omitted in the table schema. The guidelines below (typically
n MySQL format) are to add all the described primitives to the SQL schema:
* timestamp_start and timestamp_start_residual fields:
- To declare the fields:
- "timestamp_start DATETIME NOT NULL,"
- "timestamp_start_residual INT UNSIGNED NOT NULL,"
- To add them to the primary key:
- "PRIMARY KEY (..., timestamp_start, timestamp_start_residual, ...)"
* timestamp_end and timestamp_end_residual fields:
- To declare the fields:
- "timestamp_end DATETIME NOT NULL,"
- "timestamp_end_residual INT UNSIGNED NOT NULL,"
- To add them to the primary key:
- "PRIMARY KEY (..., timestamp_end, timestamp_end_residual, ...)"
* timestamp_arrival and timestamp_arrival_residual fields:
- To declare the fields:
- "timestamp_arrival DATETIME NOT NULL,"
- "timestamp_arrival_residual INT UNSIGNED NOT NULL,"
- To add them to the primary key:
- "PRIMARY KEY (..., timestamp_arrival, timestamp_arrival_residual, ...)"
This works similarly for 'timestamp_min', 'timestamp_min_residual', 'timestamp_max'
and 'timestamp_max_residual'.
The primitive is not declared as part of any default table version; yet will not fail
version checks which are enabled when 'sql_optimize_clauses' feature is disabled.
|
