On Wed, Jan 03, 2007 at 07:28:53PM -0800, jay alvarez wrote: > I'm trying to investigate further on the root of my problem. > So, flowscan was done processing ft-v05.2006-12-01.174500+0800. > Now it then process ft-v05.2006-12-01.175000+0800 shortly after. > Then an error message pops up: > illegal attempt to update using time 1164965700(Fri Dec 1 17:35:00 > PHT 2006) when last update time is 1164966000(Fri Dec 1 17:40:00 PHT > 2006) > And it was a chain reaction... all flows being processed since Dec 1, > 2006 5:30PM up to present keeps on (or most of the time) throwing the > same error, resulting to empty badly needed graphs. :-(
Is it the same error message with the same "last update time" value, on all subsequent messages? If not, what's there? > Any idea what's happening above? What can I do? > After processing Dec06 17:45 it recorded the last update as Dec06 > 17:40. (5 minutes earlier than the actual dated-flow? could it be that > my router's clock are 5 minutes ahead of my collector?) > Then when it began processing Dec06 1750 and tries to populate the > rrds, it is trying to record the update time as 17:35, which is 5 > minute behind the last update.. Any idea what's causing this? How to > correct this? Run the "flow-header" command on a flow file to see the timestamps of the data within. That might shed some light on things. It would be a good idea to make sure your router and collector host are both synchronized to the correct time. Turn NTP on in your router if it's not already there, and make sure the timezones are also in agreement. Also, do some web searching if you haven't already, especially on the FlowScan list - this problem sounds very familiar. _______________________________________________ Flow-tools mailing list [EMAIL PROTECTED] http://mailman.splintered.net/mailman/listinfo/flow-tools
