I'm attempting to understand and reconcile the differences I am seeing between the statistics in /ip accounting and /ip firewall mangle.
Accounting https://wiki.mikrotik.com/wiki/Manual:IP/Accounting indicates that when enabled, it should provide a cumulative byte and packet count between and source and destination address. I've enabled accounting, local, and set the threshold to 7500. I've also set the web access to the ip of my syslog server (192.168.88.23/32) and use a cronjob to write the contents of the page out to a file that I read with Splunk:
I've checked the uncounted frequently, and there isn't anything. Looking at my data, I'm pulling between 30 and 250 entries per minute, far from the threshold.
Code: Select all
* * * * * python3 /opt/splunk/etc/apps/trex/bin/mikrotik_accounting.py > /opt/data/scripts/accounting_raw.log && cat /opt/data/scripts/accounting_raw.log | sed "s/*//g" > /opt/data/scripts/accounting.log
At the same time, every hour, I'm pulling down the mangle log from my router, keeping track of my total bytes through the day. This is also done through a similar python script.
I would expect that the total bytes of accounting for a day to be equal to the total passthrough mangle, but it appears there is a discrepancy. I'm trying to find that discrepancy and get a better idea of which devices in my home are producing/receiving data, and how often that traverses my router to the internet.
Yesterday as an example:
Summed accounting byte total - 1681012373
Maximum Mangle Seen (2359 hours) - 48515815581
If both represent bytes, then in more readable Gigabytes, it comes out as:
Summed accounting byte total - 1.57 Gigabytes
Maximum Mangle Seen (2359 hours) - 45.18 Gigabytes
It was my understanding that accounting is supposed to capture ALL of the connections and their data count, and mangle is an overall representation of that.
Thanks, and please let me know if there is a post that has a similar problem. I thought I did a good job trying to find a post, but so far it's been more of a niche subject.