For some reason MT has decided that the accounting function will not be to find longer in Router OS v7
https://wiki.mikrotik.com/wiki/Manual:IP/Accounting

Ye you can use NetFlow (TrafficFlow ) but its not the same.
I can not see anywhere at this forum or other places that MT has asked its user if they like to keep it or not.

I do see here at the forum that other also like to keep it.
So MT, please do not remove the Accounting function. If needed att it as its own package.

I fully agree.
This is such a very basic trivial feature that I cannot even understand why ROS 7.x would have to ditch it.
It is more used out there than you would think!

I currently have Netflow + Splunk running. Even the Netflow implementation in RouterOS 6.x is flawed where only v5 is usabled, v9 and IPFIX have some nasty issues making them not usable to process them.(opened a ticket > 1 year ago ... never addressed).

Accounting does not support IPv6. Traffic Flow does.
I have migrated everything from Accounting to Traffic Flow (using IPFIX mode) without much issues.
There is only one major bug I encounter: the traffic byte counters, although they are 64-bit fields, in fact keep only 32-bit values that wrap around.
This means that the Active Flow Timeout has to be set to an unreasonably low value to force out the flow records before they can wrap.
That certainly has to be fixed.

I'm not sure where you got the "Requires dedicated java server" from. I am using a server written in Perl and I posted it on this forum.
Using the appropriate library it is trivially simple to write the data you are interested in to some file or database.

I would certainly prefer when MikroTik use the available programmer's time to fix Traffic Flow instead of working on two features for the same purpose.

Accounting does not support IPv6.

Would be interesting to se how many uses IPv6 today, in 5 and 10 years.
I have now the possibility to use IPv6, tried it, but did take it away, since It just gave me a much more complicated setup and no benefits extra.

At my work we do use IPv6 with Direct Access tunneling, but that is the only thing.

Accounting is an obsolete feature that was relevant maybe in 1995. Currently, it is still used only by few people.
And Openflow is completely unrelated to accounting, probably you meant Netflow (called TrafficFlow in ROS).

Maybe it would be a good idea to have some icon in winbox/webfig in v6 near to features which are going to be obsolete soon?
So people know it when they first configure it. Now, it is often unclear if some feature is safe to be used when you have been looking for something obscure.

@MRZ
You are correct. I ment NetFlow (TrafficFlow). Was mixing it some

With accounting I do not have to setup any new port. With Netflow I need an extra port and a system extra to receive it.

Accounting is an obsolete feature that was relevant maybe in 1995. Currently, it is still used only by few people.
And Openflow is completely unrelated to accounting, probably you meant Netflow (called TrafficFlow in ROS).

If you guys would proper implement Netflow on current ROS then at least...
There is v5 , v9 and IPFIX and only v5 is usable! Due to ROS not sending out the proper time-stamp field etc.
I've exchanged mails back in Aug 2020 on this, don't have the impression it was ever fixed...#[SUP-19834]

---
Unfortunately, there aren't any updates for it yet. We'll let you know once we have added any changes.
Best regards,
-----

You can call ip-accounting obsolete but hell, at least that works solid!

With accounting I do not have to setup any new port. With Netflow I need an extra port and a system extra to receive it.

With accounting you need to setup some system that will retrieve the accounting on a regular basis.
So there is no real difference.

I already have Syslog that sends data to Splunk using port UDP 514.
To setup netflow I need setup port typically UDP 9995 as well.
Then I need an extra solution/software to handle the netflow data.
Not simple to setup for small home network.

One more vote to implement this feature in RoS 7.xx , it's very simple and very good. My reasons are these:

1. Using IPv6 for end customers is still not common - things are changing but it will take many years before we stop using ipv4. So whoever is using IPv6 will not use this ip-accounting anyway.
2. We have simple software which is checking N mikrotik routers over the country and collect this ip-accouting file. Then a script is used to collect and save the traffic for users and make RRD graphs.
3. These mikrotik routers are not used by same company so they have nothing in common between. Because of this we can't use one NETFLOW collector, and making 100 NETFLOW collectors for each mikrotik will be overkill.

So if possible to keep ip-accounting for ipv4 will be great.

There has to be another solution for that. I do not care about /ip accounting and think it probably should be removed as to not clutter things up with useless old components.

Maybe you can use one netflow collector and have something run through that to generate RRD graphs on 100 different pages, one for each customer?

Also note that you can use /ip kid-control devices to track usage and rates per device - this may be an alternative to /ip accounting in some cases, and it works with both IPv4 and IPv6.

There has to be another solution for that. I do not care about /ip accounting and think it probably should be removed as to not clutter things up with useless old components.

Some stupid response. Just because you do not like it, it should be removed??
I do not use BGP, OSP,RIP, Mesh, IPv6, ZeroTier +++++ so all that could then be removed then.

This is what I do like about MT, all the possibility to do things.
If you have tried to setup Netflow, you will see quickly that things become complicated.
Accounting is simple to setup.

If its removed due to save space, please add it as its own package.

It should be possible to make a Docker Container with a simple Netflow collector that receives the Netflow data, stores it locally (dropping a lot of information in the process), and returns it in the format that accounting uses now.
Then configure Netflow (Traffic Flow) to send the appropriate data to that container installed on the local router and have the remote system poll the accounting data from the container via some dst-nat.

I agree, a docker container would make the most sense for this functionality.

If all you need to track is the bandwidth used by individual clients and graph those, /ip kid-control devices should be sufficient

If you need more detail to see what destinations those clients went to and what they used, then netflow makes the most sense.

Yeah it would be a nice toy project for me to experiment with containers.
Unfortunately at the moment the container feature is not available for the v7.1rc6 version that I run as a betatest on my home router.
(and v7 is not yet ready for production use at work and in the hamnet)

/ip kid-control

I have not looked at Kid Control.
Can you there see traffic to/from all devices without adding one and one device to a list.
Can those data be sent out using Syslog?

Here is some graf taken from Accoutning. Easy to setup and easy to graph with Splunk and handles many devices.
.

Accouning?

I have not looked at Kid Control.
Can you there see traffic to/from all devices without adding one and one device to a list.
Can those data be sent out using Syslog?

Yes, to both. Kid Control tracks devices and packets sent/received by those devices and current rate for those devices, even if those devices haven't been added manually. For instance I can see the bandwidth usage for the managed light switch in the kitchen that has both IPv4 and IPv6 addresses, even though I haven't manually defined it as a "kid". Kid-Control tracks the usage of the managed light switch regardless of how many IPv4 or IPv6 addresses it has, because it matches it based on the MAC address, and this happens dynamically. Since these values can be easily read by any kind of script, I'm sure they can easily be sent by syslog.

Don't you dare Accouning my traffic.

Interesting.

As soon as you add a profile at kid-control, it start to account data in the devices menu.
There number just goes opp as long as its used. So a simple diff (in splunk) can see how much since last check.
Will do have a test to see if it can replace the ip accounting...

Kid control seem to give what I need (and maybe other)

Will try to make a dashboard for it in Splunk and compare it to Accounting.

Accounting
+ Gives detailed info on all transaction to/from all ip.
- Does not work in win 7.x
- Gives a lot of log lines (one for each transaction)

Kid Control
+ Works with all new RouterOS including 7.x
+ Gives less log line (one for each IP)
+ Can later be used to limit a user (based on show history)
- Does not gives detailed info about sessions

For anyone interested, there's pmacct.
http://www.pmacct.net/

It's not for the faint of heart, as it's a collection of tools to be able to do IP Accounting using NetFlow, among many other methods, store that data to a backend of your choice, and then build an interface (if needed) around that.

Kid Control seems to be way to go.
After some testing and making a new dashboard in Splunk, I do get the same data and same graphs as I do get from IP accounting.
If I do not find any other big bug or other problem, this will be released in the next version of MikroTik for Splunk.
Then we do have a working version for Router OS 7.x

One negative thing is that script needs to be updated to collect these data, so If you have many routers, all needs to be update.

Here is a sample graph. (See the missing bottom graph compare to the IP Accounting)
.

Interesting.

As soon as you add a profile at kid-control, it start to account data in the devices menu.
There number just goes opp as long as its used. So a simple diff (in splunk) can see how much since last check.
Will do have a test to see if it can replace the ip accounting...

Strange, it does not do that over here on 6.47.7
So I created a "kid profile" called "Accounting" and left basically other option empty and "enabled" it.
The "devices" menu remains empty ?

/ip kid-control
add disabled=no fri="" mon="" name=Accounting rate-limit="" sat="" sun="" thu="" tue="" tur-fri="" tur-mon="" tur-sat="" tur-sun="" tur-thu="" tur-tue="" tur-wed="" wed=""
/ip kid-control>

I used "00:00:00-1d 00:00:00" for the day intervals, maybe it is required that at least one of the profiles is active at the time?

You need to be in an active time range to get traffic data.

So to get all day from 00:00:00 to 23:59:59, I do use:

You need to be in an active time range to get traffic data.

So to get all day from 00:00:00 to 23:59:59, I do use:

Code: Select all

/ip kid-control
add name=Monitor mon=0s-1d tue=0s-1d wed=0s-1d thu=0s-1d fri=0s-1d sat=0s-1d sun=0s-1d

In WebFig I cannot add it like that "0s-1d" , it will not accept it.
The other notation like 00:00:00-1d 00:00:00 worked and indeed the "devices" tables has entries in it.

I have no problem cut and past this to terminal:
Tested on various routers 6.x and 7.x

In WebIF, it looks like this:

I have no problem cut and past this to terminal:

Code: Select all

/ip kid-control
add name=Monitor mon=0s-1d tue=0s-1d wed=0s-1d thu=0s-1d fri=0s-1d sat=0s-1d sun=0s-1d

Yes in commandline mode it works ok but you cannot put 0s-1d in the input fields in webfig or winbox.
Guess that should be allowed...

There are tons of inconsistent between WinBox and CLI.
Here is one that do irritate me.
Add/Edit/Delete a user:
Winbox: System->User
Cli: /user

Why in the world are user in Cli not under /system user ????

The menu system is not exactly the same between winbox and cli...
E.g. "bridge" is a toplevel item in winbox while in cli it is /interface bridge (more logical if you ask me...)
But there are also strange menu locations, e.g. "kid-control" is under "ip" while it works at MAC address level. Should it be under /system?
Items that are under IP also have IPv6 functions, even though there is a separate IPv6 menu. Should be under /system probably.
Well, moving things over (like /routing/rule has been moved from /ip route rule) is also a bit cumbersome...

There are tons of inconsistent between WinBox and CLI.
Here is one that do irritate me.
Add/Edit/Delete a user:
Winbox: System->User
Cli: /user

Why in the world are user in Cli not under /system user ????

Try to find modem settings in CLI for LTE device if under Winbox it's to be found under interface / lte / modem....

Hint: nothing with modem

Or SIM card settings...

Removing Accounting seems not good for me, because it will break all scripts which has it with syntax error, which can't be handled with :do { ... } on-error={ ... }.

I'm using that for some time to track local traffic usage in routers, not remotely.

Same issue as with `signal-treshold` becames `signal-threshold` in the `system-leds` menu after some release, which breaks things for me, so I've to force check RoS version and use :parse to make my script work at all possible firmwares when new router comes.

Sad to hear, because I'll have to spend some time to replace it with kids control if possible.

Yeah, when you upgrade to new software there sometimes will be work for you to do. That is reality.
It must be a small amount of work compared to what it took to create v7

+1 to keep accounting

+1 to keep accounting

+1 to keep Accounting

For 1 reason - it works brilliantly and simply with attix 5 to give me a simple straightforward dynamic realtime view of bandwidth usage by IP on my network.

Now if someone could give pointers on how to get attix5 to work with the kid-control data that would solve my use case.

So quick and easy to see who is hogging the bandwidth on the local network.

+100 to keep Accounting

(i intentionally use netflow and traffic flow interchangeably below, to distinguish it from Traffic-Accounting , im aware trafficFlow=Netflow):

Netflow does not provide the resolution (and accuracy) i have been able to achieve with custom code + mikrotiks, unique, Traffic Accounting feature.

I have tried netflow for years, and see very poor detail for traffic behind NAT (which is almost always), additionally, it seems that you cant use Fast-Track (understandably) with netflow(trafficFlow), if you wish to capture all private, NAT'd (local) ip addresses .

And even with (Fast-track disabled + bridge = "use ip firewall")* ive still had issues seeing Nat'd traffic on TrafficFlow collectors (ie seeing 192.168.1.42 -> 17.2.54.1 actual bandwidth usage over time).
* = both settings i usually have to make ONLY for netflow. (Traffic Accounting does not have this requirement!)

I have tested both PAID and opensource netflow collectors. WIth trafficFlow: I can get accurate, great data for Mikrotiks' Public-IP -> internet-PublicIP , but very inaccurate data for the devices behind the Mikrotiks' Public-IP (ie the NAT'd hosts, which is the data i need).

Traffic-Accounting changed all of this! I have code pulling the http page every 10s and sending data over to graphite , and influxDB , for multiple large install mikrotiks. Im now seeing perfect data for my internal IPs (which is the data i need in my use-case).

Bottom line, to see the full picture of ALL your traffic , it seems you need to use BOTH TrafficFlow (netflow) AND mikrotiks' Traffic-Accounting. This provides you with data that even the top $$ routers wont provide you with!

There is no reason to remove a feature like this that is unique to mikrotik ros, and very powerful.

I have tried

Have you looked at Kid control? For me it gives more or less the same as I did get from accounting.

There is no reason to remove a feature like this that is unique to mikrotik ros, and very powerful.

Of course there is! Do you think that MikroTik removes such a feature just to annoy you?
Likely it was either relying on a kernel feature in the old kernel that no longer exists, or MikroTik developed their own solution in the old kernel for this and it is too difficult to re-do that in current kernels e.g. due to an architecture change.

And as written before, now there is kid control, which when enabled will keep stats in a more convenient way than accounting did, especially when it is to keep traffic stats for local hosts and it isn't important to what outside host the traffic is.

Just try it. Enable it using:

/ip kid-control
add fri=0s-1d mon=0s-1d name=any sat=0s-1d sun=0s-1d thu=0s-1d tue=0s-1d wed=0s-1d

Then watch the rate and bytes stats for your devices, without even having to regularly "collect" them.

Of course there is! Do you think that MikroTik removes such a feature just to annoy you?
Likely it was either relying on a kernel feature in the old kernel that no longer exists, or MikroTik developed their own solution in the old kernel for this and it is too difficult to re-do that in current kernels e.g. due to an architecture change.

Then watch the rate and bytes stats for your devices, without even having to regularly "collect" them.

Ability to collect this data and use it with external tools such as influxdb + grafana IS the important part. (its why mikrotik offers the web-access part to /ip accounting , just look at the format of that output.)

I have looked at Kid-control, it is not a replacement for the power that /ip accounting gives the user. we have /ip accounting -> influxDB running on routers with 1000s of nat'd users, and with little/no impact to performance. (not saying that kid-control is performance hungry, just that kid-control does not scale, and gives no ability to get the data out of mikrotik).

That is not correct, you can get the data out of the MikroTik using an API call just fine!
You may need to write a different agent for your monitoring system. One that connects to the API port, authenticates, and then issues a "/ip/kid-control/device/print detail" command and retrieves the results.

/ip accounting is not future-proof as it never supported IPv6.

+1 to keep /ip accounting
We also use a bandwidth monitor that is programmed with the ip accounting feature.

At this point, IP Accounting is ancient history and will not be added back.

Has netflow on v7 already been fixed to properly send 64-bit bytecount fields? In v6 the fields are 64-bit but they contain only 32-bit values, a known problem.

I want to monitor the internet usage of all my clients in the network Per IP.
Since IP/Acounting has been removed from v7, is there any solution for that?
which tool can I use except splunk ?

You can use Netflow and a Netflow collector. There are several solutions that have a Netflow collector, but mainly commercial.
There is also the Perl library Net::Flow which you can use to make your own custom collector that writes the output in the format your existing tool requires.
I used it to write a TAB-separated file that I keep only in case of abuse reports.

I want to monitor the internet usage of all my clients in the network Per IP.
Since IP/Acounting has been removed from v7, is there any solution for that?
which tool can I use except splunk ?

You could use the "Kid Control" and recycle parts of the script Jotne has provided. With the difference that you output to a classic (Linux) SYSLOG-server that will simple write "files" eg on a hourly basis
And with these files and some correct parsing, same goal is possible.
But yes, you will need to adapt your "backend" a bit.

Here you see an example from Splunk using Kid Control. I was some mad when IP Accounting was removed, but I get the same from Kid Control, just needed to change the script and Splunk dashboards.
.

Hey everyone,

I’m excited to share with you a Python package I've developed as an alternative solution for handling MikroTik accounting in Version 7 using TrafficFlow V9. "netflow2json" simplifies the collection and analysis of Netflow V9 traffic data and is designed to be alternative of deprecated MikroTik accounting feature.

This package provides an effortless way to manage and process Netflow V9 traffic data in Python.
checkout post blow:
viewtopic.php?p=1032752#p1032752