Event time when compiled with NSEL/NEL option.

[phaag]

The ”auto” output shows the event time when compiled with NSEL/NEL option. If you overwrite that with “line” oder “extended” you see the flow time. This actually means the exporter does not properly export the event time but the flow time.

Understood, so there are two separate issues here!

First: Is it correct that nfdump compiled with NSEL options requires all the sources to support NSEL? In my test bed example I have sFlow sources for which NSEL doesn't make sense at all and a couple of routers (Mikrotik) that export flows with the NSEL option.

I think the most sensible approach for the automatic format would be to display the flow timestamps in case the even timestamps were not available.

The second is trickier, dealing with buggy/poor implementations of NSEL like Mikrotik's. They are using the X- IP address fields but they are not including any event related fields.

Anyway, given that it is an "auto" format, don't you think it would be a lesser evil to display the flow start timestamp in both cases when the event timestamp is not available?

Originally posted by @borjam in #409 (comment)

[phaag]

If you compile nfdump with --enable-nsel it enables the nsel/nel structures for processing the netflow data. It does not affect the collector. So every collector stores all the nsel/nel tags as well, regardless how compiled.
The compile flag is required as flow processing with nsel/nel requires substantial more memory. This may change in future, when the internal data handling will change and therefore the compile option is no longer needed.

As of the display option - the nsel compile option changes the default format to display event records, which makes sense. There is always a tradeoff between convenience and required information. If you have multiple and mixed sources, such as plain netflow/ipfix as well as nsel exporters, you have to carefully select what output you need from which sources. You won't be able to simply select auto without thinking the consequences.

It's a nightmare about all the different and buggy and/or poor implementations of NSEL, as flexible netflow (fnf) is too flexible and it is almost impossible to fulfil all auto requirements. Although flow start/end and event time is not the same, it is mostly expected the same. If you have special cases in your environment, I would highly recommend to customise your own output formats of choice. To do so you can modify <prefix>/etc/nfdump.conf most likely /usr/local/etc/nfdump.conf and add and or modify the output formats. The syntax is pretty much self explanatory.
Therefore I do not want to change anything at the default behaviour for nfdump output formats, as each user can craft it's own formats.