No accounting fields in event handler about conntrack-logger HOT 3 CLOSED

Hey,

With 4.9 kernel and libnetfilter_conntrack-1.0.6 and conntrack-tools-1.4.4, don't see any kind of bytes from conntrack -E here, e.g. for curl google.com:

    [NEW] tcp      6 120 SYN_SENT src=10.1.0.13 dst=74.125.232.166 sport=53382 dport=80 [UNREPLIED] src=74.125.232.166 dst=10.1.0.13 sport=80 dport=53382
 [UPDATE] tcp      6 60 SYN_RECV src=10.1.0.13 dst=74.125.232.166 sport=53382 dport=80 src=74.125.232.166 dst=10.1.0.13 sport=80 dport=53382
 [UPDATE] tcp      6 432000 ESTABLISHED src=10.1.0.13 dst=74.125.232.166 sport=53382 dport=80 src=74.125.232.166 dst=10.1.0.13 sport=80 dport=53382 [ASSURED]
 [UPDATE] tcp      6 120 FIN_WAIT src=10.1.0.13 dst=74.125.232.166 sport=53382 dport=80 src=74.125.232.166 dst=10.1.0.13 sport=80 dport=53382 [ASSURED]
 [UPDATE] tcp      6 30 LAST_ACK src=10.1.0.13 dst=74.125.232.166 sport=53382 dport=80 src=74.125.232.166 dst=10.1.0.13 sport=80 dport=53382 [ASSURED]
 [UPDATE] tcp      6 120 TIME_WAIT src=10.1.0.13 dst=74.125.232.166 sport=53382 dport=80 src=74.125.232.166 dst=10.1.0.13 sport=80 dport=53382 [ASSURED]

Same with xml output, no byte counters of any kind, as far as I can tell.

Iirc kernel acct module does some kind of netflow-like table, but don't think it has much to do with conntrack module and its data.
I'd probably use ulogd2 to gather netflow, though maybe there're better tools available for it these days, haven't checked in like 10 years.

from conntrack-logger.

Oh btw, don't actually know about Ubuntu, maybe it has patched kernel and conntrack-tools or something (seems unlikely to me) - it's only mentioned in the README because someone submitted a patch last year iirc.
Haven't really used these scripts myself for a few years now, but this kind of stuff tends to work for a long time, as kernel ABI and basic libs like these change very rarely.

from conntrack-logger.

¯\_(ツ)_/¯

from conntrack-logger.