I think i ask wrong qustion. I mean only Event CREATE / DELETE Will show nat ip address...
I am give up for Fedora . Right now use Centos 6 + ipt_netflow + nfsen+ nfdump ipt_netflow...
After install contract-tools this is the message [NEW] icmp 1 30 src=172.17.16.36...
Is in this server perform nat . And i have enable IMQ, pppoe-server in this server...
natevent is not working