# Accounting file for ulog-acctd(8)

# Listen to which multicast groups (1-32, see iptables(8))

multicast groups=1

# The receive buffer that is allocated by the kernel for recv calls on
# the Netlink socket. Use sysctl(8) to adjust "net/core/rmem_max" to
# allow for larger buffers than 64kBytes.

# socket receive buffer = 65536


# The hash table is used to store the accounting data. Increase it if
# ulog-acctd consumes too much CPU time. Set it to a prime number.

# hash table size = 65537


# Define files that ulog-acctd generates

accounting file=/var/log/ulog-acctd/account.log
dump file=/var/log/ulog-acctd/dump
debug file=/var/log/ulog-acctd/debug.log
pid file=/var/run/ulog-acctd.pid

# What should be written to the debug log?
# Possible values:
#  config
#  state
#  syscall
#  misc
#  statistics
#  signal
#  error
#  annoying

# debug = statistics, error
debug = syscall, misc, statistics, error, error-packet 

# Accounting format, specified with a format string with similar
# syntax to printf(3)
#
#  %h hostname
#  %t timestamp
#  %p protocol
#  %s source IP
#  %S source port
#  %d destination IP
#  %D destination port
#  %P packets
#  %b bytes
#  %i incoming interface
#  %o outgoing interface
#  %f prefix
#
#  \t tab
#  \n newline
#  \\ literal \
#  \" literal "
#  \% literal %
#  %% literal %

# accounting format="%h\t%t\t%p\t%s\t%S\t%d\t%D\t%P\t%b\t\"%i\"\t\"%o\"\t\"%f\"\n"
# accounting format="%t\t%s\t%d\t%b\t%i\t%o\t%f\n"

accounting format="%t\t%p\t%s\t%S\t%d\t%D\t%P\t%b\t%i\t%o\t%f\n"

# Use this to generate CISCO "ip accounting output-packets"-compatible
# accounting data:
#
#  accounting format="%s %d %P %b\n"

# Insert this for empty interface

empty interface="none"


# Insert this for empty prefix

empty prefix="none"

flush=30
fdelay=0

# $Id: ulog-acctd.conf,v 1.8 2003/08/11 15:41:43 bengen Exp $