Community discussions

MikroTik App
 
trex
just joined
Topic Author
Posts: 1
Joined: Mon Nov 16, 2020 3:45 am

Reconciling Accounting and Mangle

Mon Nov 16, 2020 4:13 am

Good day Mikrotik forums!

I'm attempting to understand and reconcile the differences I am seeing between the statistics in /ip accounting and /ip firewall mangle.

Accounting https://wiki.mikrotik.com/wiki/Manual:IP/Accounting indicates that when enabled, it should provide a cumulative byte and packet count between and source and destination address. I've enabled accounting, local, and set the threshold to 7500. I've also set the web access to the ip of my syslog server (192.168.88.23/32) and use a cronjob to write the contents of the page out to a file that I read with Splunk:
* * * * * python3 /opt/splunk/etc/apps/trex/bin/mikrotik_accounting.py > /opt/data/scripts/accounting_raw.log && cat /opt/data/scripts/accounting_raw.log | sed "s/*//g" > /opt/data/scripts/accounting.log
I've checked the uncounted frequently, and there isn't anything. Looking at my data, I'm pulling between 30 and 250 entries per minute, far from the threshold.

At the same time, every hour, I'm pulling down the mangle log from my router, keeping track of my total bytes through the day. This is also done through a similar python script.

I would expect that the total bytes of accounting for a day to be equal to the total passthrough mangle, but it appears there is a discrepancy. I'm trying to find that discrepancy and get a better idea of which devices in my home are producing/receiving data, and how often that traverses my router to the internet.

Yesterday as an example:
Summed accounting byte total - 1681012373
Maximum Mangle Seen (2359 hours) - 48515815581

If both represent bytes, then in more readable Gigabytes, it comes out as:
Summed accounting byte total - 1.57 Gigabytes
Maximum Mangle Seen (2359 hours) - 45.18 Gigabytes

It was my understanding that accounting is supposed to capture ALL of the connections and their data count, and mangle is an overall representation of that.

Thanks, and please let me know if there is a post that has a similar problem. I thought I did a good job trying to find a post, but so far it's been more of a niche subject.

Who is online

Users browsing this forum: Bing [Bot], RomanSab, sabnamtnkadu and 119 guests