I ran into the same problem as Chris Waters did - nfsen works nicely,
any profile other than default/live does get created but never receives
any data. After debugging this for a while, it appears that nfprofile
does not handle channel_sourcelist entries with dashes ("-"):[EMAIL PROTECTED]:/usr/src/nfdump-snapshot-20070312# nfprofile -I -p /var/flows/nfsen/profiles-data -P /var/flows/nfsen/profiles-stat -S 1 -M /var/flows/nfsen/profiles-data/live/jc-blue_cgn1:jcore1_cgn2 -r nfcapd.200708021150 Blubb#Test-HTTP#2#Egress#jc-blue_cgn1|jcore1_cgn2 Process line 'Blubb#Test-HTTP#2#Egress#jc-blue_cgn1|jcore1_cgn2 ' Setup channel 'Egress' in profile 'Test-HTTP' group 'Blubb', channellist 'jc-blue_cgn1|jcore1_cgn2' Filter: (ident jc-blue_cgn1 or ident jcore1_cgn2) and (port 80) line 1: syntax error at '-' creating a profile with just "jcore1.cgn2" works fine. I could see that Chris had router ident names like "rus-kla-ops-1" so that's probably the same issue. I haven't been able to figure out the exact problem within nfprofile.c, somebody with better C skills needs to do that :p Oh, and also nfsend should probably not fail silently when this happens. kind regards, Felix -- Felix Schueren, Head of NOC mailto:[EMAIL PROTECTED] Host Europe GmbH - http://www.hosteurope.de Welserstrasse 14 - D-51149 Koeln - Germany Telefon (0800) 4678387 - Telefax (01805) 663233 HRB 28495 Amtsgericht Koeln - UST ID DE187370678 Geschaeftsfuehrer U. Braun - M. Read - S. Porter Fuer diese Nachricht gilt: http://www.hosteurope.de/disclaimer.html ------------------------------------------------------------------------- This SF.net email is sponsored by: Splunk Inc. Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/ _______________________________________________ Nfsen-discuss mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
