Hi Peter, Hope you had a nice vacation. When nfcapd stops rotating files, there are a few things that I noted from the .nfstat file.
houengv205:/var/opt/netflow/nfdump # cat .nfstat first=1375892354 last=1375892354 size=18446744073656061952 maxsize=0 numfiles=0 lifetime=604800 watermark=1 status=3 Above is the content of .nfstat when nfcapd had stopped rotating files for more than 24 hours. As you can see, first and last shows the same timestamp and size is totally random. Same is the case of numfiles, which is more than 500 as per the ls output in that directory. When I restarted nfcapd, it updated the .nfstat as: houengv205:/var/opt/netflow/nfdump # cat .nfstat first=1375886400 last=1376214000 size=1980444672 maxsize=0 numfiles=547 lifetime=604800 watermark=1 status=0 The command line (arguments to nfcapd) is : /opt/novell/sentinel/3rdparty/nfdump/bin/nfcapd -t 600 -l /var/opt/novell/sentinel/data/netflow/nfdump -p 3578 -T all -w -B 104857600 ls output from nfcapd data directory: -rw------- 1 novell novell 1.3M Aug 11 03:40 nfcapd.201308110330 -rw------- 1 novell novell 1.4M Aug 11 03:50 nfcapd.201308110340 -rw------- 1 novell novell 1.3M Aug 11 04:00 nfcapd.201308110350 -rw------- 1 novell novell 1.3M Aug 11 04:10 nfcapd.201308110400 -rw------- 1 novell novell 1.4M Aug 11 04:20 nfcapd.201308110410 -rw------- 1 novell novell 1.3M Aug 11 04:30 nfcapd.201308110420 -rw------- 1 novell novell 1.4M Aug 11 04:40 nfcapd.201308110430 -rw------- 1 novell novell 1.3M Aug 11 04:50 nfcapd.201308110440 -rw------- 1 novell novell 276 Aug 12 05:40 nfcapd.current.8635 Also, just an observation (could be wrong), ever since nfcapd started writing to nfcapd.current.<pid>, I guess, there are issues w.r.t it when it gets restarted after a kill or some such, because, when previous versions of nfcapd kept it as nfcapd.current - a restart was able to pick up what was left in nfcapd.current. I am just pointing to an unclean shutdown of nfcapd process. Let me know if you need any further detail. Best, V. Varadhan On Mon, 2013-08-12 at 08:19 +0200, Peter Haag wrote: > Hi, > Hmm .. I'm not aware of any file rotate issues. 1.6.10 has some bugs - > 1.6.10p1 will follow in a few days. > Sorry for not responding earlier - I was on holiday. > > - Peter > > > On 7/22/13 W30 10:35, Veerapuram Varadhan wrote: > > Hi, > > > > I have been running nfcapd 1.6.10 and have observed that nfcapd fails to > > rotate the files in about 7 or 8 hours. > > > > I am running nfcapd with -P option from a program to be able to > > start/stop it as below: > > > > nfcapd -T all -w -B 1024000 -t 60 -l /var/opt/nfdump -p 3578 > > -P /var/run/nfcapd.pid > > > > I am not sure on what all details to provide in order to be able to get > > a clue of what is happening. > > > > Let me know from where to start debugging it. Googling also didn't help > > much in tracking the issue. > > > > Kindly let me know of any options to figure what is happening. This is > > currently a major concern in using nfdump tools. > > > > Best, > > > > V. Varadhan > > > > > > > > > > > > ------------------------------------------------------------------------------ > > See everything from the browser to the database with AppDynamics > > Get end-to-end visibility with application monitoring from AppDynamics > > Isolate bottlenecks and diagnose root cause in seconds. > > Start your free trial of AppDynamics Pro today! > > http://pubads.g.doubleclick.net/gampad/clk?id=48808831&iu=/4140/ostg.clktrk > > _______________________________________________ > > Nfdump-discuss mailing list > > [email protected] > > https://lists.sourceforge.net/lists/listinfo/nfdump-discuss > > > ------------------------------------------------------------------------------ Get 100% visibility into Java/.NET code with AppDynamics Lite! It's a free troubleshooting tool designed for production. Get down to code-level detail for bottlenecks, with <2% overhead. Download for free and get started troubleshooting in minutes. http://pubads.g.doubleclick.net/gampad/clk?id=48897031&iu=/4140/ostg.clktrk _______________________________________________ Nfdump-discuss mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/nfdump-discuss
