----- Original Message ---- From: Ed Ravin <[EMAIL PROTECTED]> To: jay alvarez <[EMAIL PROTECTED]> Cc: [email protected] Sent: Thursday, January 4, 2007 7:13:57 AM Subject: Re: [Flow-tools] No graphs created after flow-capturing a month of flows (Illegal attempt to update using time)
On Wed, Jan 03, 2007 at 05:04:32PM -0600, jay alvarez wrote: > rrd files contain data that is averaged as time progresses and new entries > get inserted. You can't add data with timestamps older than the most > recent data already in the file. That error message, alas, is unclear for > this case. > You can still build your graphs, but you have to feed the log files to > FlowScan in chronological order. Delete the rrd files and start from > scratch, making sure that FlowScan sees the oldest flow file first. I think I have tried that too. What I did was remove all those rrds and create symlinks to Dec 01* flows first, then feed it to flowscan. December 1 flows, seems to get processed normally, as I rarely see that "illegal attempt" error. After processing all Dec01 flows, I then followed it up with Dec 02. And here is where the error starts appearing from time to time. Then finally I decided to feed the rest of the flows hoping somehow the error will be gone after processing two to three days, but right now it is processing upto Dec15 and as I have said, it keeps on throwing "illegal attempt" error. Is there anymore I can do here? :-( Somewhere I've read about dump and restore thing about the rrd and manually modifying the xml files, however I'm not sure if this has anything to do here. But if this is the case, I will be willing to do this once and for all. Should you need any sample flows, please let me know. Also, I noticed that flowscan processes the flows in chronological order already so I decided to include the rest of the flows. A quick "grep working" on the log shows: 2007/01/04 07:16:49 working on file /var/netflow/ft/ft-v05.2006-12-15.123000+0800... 2007/01/04 07:17:02 working on file /var/netflow/ft/ft-v05.2006-12-15.123500+0800... 2007/01/04 07:17:16 working on file /var/netflow/ft/ft-v05.2006-12-15.124000+0800... 2007/01/04 07:17:30 working on file /var/netflow/ft/ft-v05.2006-12-15.124500+0800... 2007/01/04 07:17:44 working on file /var/netflow/ft/ft-v05.2006-12-15.125000+0800... 2007/01/04 07:17:59 working on file /var/netflow/ft/ft-v05.2006-12-15.125500+0800... 2007/01/04 07:18:13 working on file /var/netflow/ft/ft-v05.2006-12-15.130000+0800... 2007/01/04 07:18:24 working on file /var/netflow/ft/ft-v05.2006-12-15.130500+0800... 2007/01/04 07:18:37 working on file /var/netflow/ft/ft-v05.2006-12-15.131000+0800... 2007/01/04 07:18:51 working on file /var/netflow/ft/ft-v05.2006-12-15.131500+0800... 2007/01/04 07:19:04 working on file /var/netflow/ft/ft-v05.2006-12-15.132000+0800... 2007/01/04 07:19:21 working on file /var/netflow/ft/ft-v05.2006-12-15.132500+0800... 2007/01/04 07:19:35 working on file /var/netflow/ft/ft-v05.2006-12-15.133000+0800... 2007/01/04 07:19:53 working on file /var/netflow/ft/ft-v05.2006-12-15.133500+0800... 2007/01/04 07:20:10 working on file /var/netflow/ft/ft-v05.2006-12-15.134000+0800... 2007/01/04 07:20:25 working on file /var/netflow/ft/ft-v05.2006-12-15.134500+0800... 2007/01/04 07:20:45 working on file /var/netflow/ft/ft-v05.2006-12-15.135000+0800... 2007/01/04 07:21:02 working on file /var/netflow/ft/ft-v05.2006-12-15.135500+0800... 2007/01/04 07:21:17 working on file /var/netflow/ft/ft-v05.2006-12-15.140000+0800... 2007/01/04 07:21:34 working on file /var/netflow/ft/ft-v05.2006-12-15.140500+0800... 2007/01/04 07:21:50 working on file /var/netflow/ft/ft-v05.2006-12-15.141000+0800... 2007/01/04 07:22:07 working on file /var/netflow/ft/ft-v05.2006-12-15.141500+0800... 2007/01/04 07:22:22 working on file /var/netflow/ft/ft-v05.2006-12-15.142000+0800... 2007/01/04 07:22:38 working on file /var/netflow/ft/ft-v05.2006-12-15.142500+0800... __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com
_______________________________________________ Flow-tools mailing list [EMAIL PROTECTED] http://mailman.splintered.net/mailman/listinfo/flow-tools
