On Wed, Jan 03, 2007 at 03:25:57PM -0800, jay alvarez wrote: ... > > You can still build your graphs, but you have to feed the log files > to > > FlowScan in chronological order. Delete the rrd files and start > from > > scratch, making sure that FlowScan sees the oldest flow file first.
> I think I have tried that too. What I did was remove all those rrds > and create symlinks to Dec 01* flows first, then feed it to flowscan. > December 1 flows, seems to get processed normally, as I rarely see > that "illegal attempt" error. After processing all Dec01 flows, I then > followed it up with Dec 02. And here is where the error starts > appearing from time to time. You're going to have to get your hands dirty - start again, and stop things when you see that error. Find out what went wrong, fix it, and restart the process. Somewhere, somehow, FlowScan got ahold of an out-of-order file, or otherwise move the timestamp ahead of your backlog of data. Use "date -r NNNNNN" to convert the numeric timestamps in the error message into normal dates, that should give you a hint. Also, look for running jobs or cron entries that might call FlowScan or drop things in its directory. It might be the "link me" script that runs on the 5 minute rotation that is somehow confusing things. _______________________________________________ Flow-tools mailing list [EMAIL PROTECTED] http://mailman.splintered.net/mailman/listinfo/flow-tools
