/etc/naccttab is in net-acct 0.71-9.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 | flush 300 # flush every 5 minutes
# this gives the interval in seconds
# when the accumulated data is flushed
# to the output file
fdelay 60 # this defines after how many seconds
# of inactivity a certain record of
# traffic information may be written out
# this helps making the logfiles smaller
# since only one output record will be
# generated for related traffic
file /var/log/net-acct/net-acct.log # defines output file
# this is the regular output file of
# the daemon
dumpfile /var/log/net-acct/dump # defines dump file
# this is used to dump the not yet
# written information so this is not
# lost should the machine crash
# on startup an eventuelly existing
# file of this name will be moved
# to *.o
#notdev eth1 # Dont log entries for this device
# Use this on routers that you dont
# log forwarded packets twice.
#device eth0 # device to put into promiscous mode
# you can specify as many as you want
# and you don't have to specify one
# (e.g. if this runs on your router)
iflimit eth0 # on machines with multiple interfaces,
# log only packets on this interface
# mutually exclusive with hostlimit
ignoremask 255.255.255.0 # Ignore traffic on same class C net
# This means traffic that is on
# your local LAN is not counted.
# This is useful for NFS etc.
# Not giving this option causes everything
# to be counted.
# This can degrade performance seriously!
ignorenet 127.0.0.0 255.0.0.0 # ignore loopback net
# You can define as many ignorenets as
# you want. Ignoring a net with
# ignorenet is not as efficient as
# ignoremask. Thus you should exclude
# your local network with ignoremask,
# not with ignorenet (although this is
# is possible).
# masqif 192.168.72.141 # if compiled with -DREMAP_MASQUERADE:
# ipnumber you are masquerading as,
# this remaps ip/port for incoming
# connections (e.g. ftp-data) to ip/port
# of the masqueraded destination
debug 2 # set debugging level
debugfile /var/log/net-acct/net-acct.debug # where to put debugging info
# Device configuration
# Defines where the real data starts for each type of interface
# First give the name prefix, then the offset in bytes to the start
# of the real data, then the offset of the type field in bytes. If
# there is no type field, just give a 0.
# Don't specify SLIP or PPP devices here, otherwise association of
# dynamic ip-addresses with usernames won't work
# Put device types with more traffic last.
headers tr 40 38
headers lo 14 12
headers isdn 4 0
# headers isdn 14 0 # for hdlc/trans/cisco and hdlc/trans/raw
headers eth 14 12
headers plip 14 12
# For dynamic slip/ppp
#dynamicip /var/run # where files for dynamic ip are stored
#dynamicnet 202.36.94.0 255.255.255.0 # on which network are all the
# dynamically assigned adresses
#exclude-name-lookup 202.36.94.1 255.255.255.255
#exclude-name-lookup 202.36.94.253 255.255.255.255
# hostlimit 12.34.56.78 # log only packets to/from this host
# hostlimit 34.56.78.12 # and this one too
# this option is mutually exclusive with iflimit
# For disabling certain fields
# This is commented out by default
# Field 7 is disabled by default so we match the old (pre 0.5) output format
# disable 2 # disable output of protocol
# disable 3 # disable output of source address
# disable 4 # disable output of source port
# disable 5 # disable output of destination address
# disable 6 # disable output of destination port
disable 7 # disable output of packets count
# disable 8 # disable output of byte count
# disable 9 # disable output of device name
# disable 10 # disable output of user name
# For excluding certain hosts from ignoring
# This can be useful for a kludgy way to account for proxy traffic, you'd then
# add your proxy server here.
# I guess I should consider using some filter language...
# This is commented out by default
# This does not affect addresses excluded by ignoremask,
# as this would impose too much of a performance penalty
# dontignore 127.3.4.5 255.255.255.255 # Don't ignore host 127.3.4.5,
# although it would be excluded by
# above ignorenet statement
# line sl0 ttyS0 # One way to
# assign traffic to a user is if both
# of the following conditions meet:
# a) nacctd runs on the ppp/slip server
# b) the relation between network interface
# (e.g. sl0, ppp1) and serial line (e.g.
# ttyS1) is fixed.
# You can give as many line statements
# as you want
# There is a better way now, so this is
# commented out
|