-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hi Felix,
- --On August 2, 2007 13:51:55 +0200 Felix Schueren <[EMAIL PROTECTED]> wrote:
| I ran into the same problem as Chris Waters did - nfsen works nicely,
| any profile other than default/live does get created but never receives
| any data. After debugging this for a while, it appears that nfprofile
| does not handle channel_sourcelist entries with dashes ("-"):
|
|
| [EMAIL PROTECTED]:/usr/src/nfdump-snapshot-20070312# nfprofile -I -p
| /var/flows/nfsen/profiles-data -P /var/flows/nfsen/profiles-stat -S 1 -M
| /var/flows/nfsen/profiles-data/live/jc-blue_cgn1:jcore1_cgn2 -r
| nfcapd.200708021150
| Blubb#Test-HTTP#2#Egress#jc-blue_cgn1|jcore1_cgn2
| Process line 'Blubb#Test-HTTP#2#Egress#jc-blue_cgn1|jcore1_cgn2
| '
| Setup channel 'Egress' in profile 'Test-HTTP' group 'Blubb', channellist
| 'jc-blue_cgn1|jcore1_cgn2'
| Filter: (ident jc-blue_cgn1 or ident jcore1_cgn2) and (port 80)
| line 1: syntax error at '-'
|
| creating a profile with just "jcore1.cgn2" works fine. I could see that
| Chris had router ident names like "rus-kla-ops-1" so that's probably the
| same issue.
Many thanks for debugging! I'll check that.
|
| I haven't been able to figure out the exact problem within nfprofile.c,
| somebody with better C skills needs to do that :p
|
| Oh, and also nfsend should probably not fail silently when this happens.
You are absolutely right. This is already on the todo list.
|
| kind regards,
|
| Felix
|
| --
| Felix Schueren, Head of NOC
|
| mailto:[EMAIL PROTECTED]
|
| Host Europe GmbH - http://www.hosteurope.de
| Welserstrasse 14 - D-51149 Koeln - Germany
| Telefon (0800) 4678387 - Telefax (01805) 663233
| HRB 28495 Amtsgericht Koeln - UST ID DE187370678
| Geschaeftsfuehrer U. Braun - M. Read - S. Porter
|
| Fuer diese Nachricht gilt: http://www.hosteurope.de/disclaimer.html
|
| -------------------------------------------------------------------------
| This SF.net email is sponsored by: Splunk Inc.
| Still grepping through log files to find problems? Stop.
| Now Search log events and configuration files using AJAX and a browser.
| Download your FREE copy of Splunk now >> http://get.splunk.com/
| _______________________________________________
| Nfsen-discuss mailing list
| [email protected]
| https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
- --
_______ SWITCH - The Swiss Education and Research Network ______
Peter Haag, Security Engineer, Member of SWITCH CERT
PGP fingerprint: D9 31 D5 83 03 95 68 BA FB 84 CA 94 AB FC 5D D7
SWITCH, Werdstrasse 2, P.O. Box, CH-8021 Zurich, Switzerland
E-mail: [EMAIL PROTECTED] Web: http://www.switch.ch/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (Darwin)
iQCVAwUBRrbbrP5AbZRALNr/AQLG+wP/fuSFAQGInNY7D3bAoOoZgM7PUfc3vWSV
hfRm8BRh3YfagfGwzkRQJuVGA2pqyK+KxVRxWyzrrw6Js/Z7db/y7nnfK7H3kjbm
aumquntLbKn/qE5bYWt6eBfhzyv0h+BrEMJyCymh31xvmBCv5z9GmtKSJtOR9+CJ
3rI6Ag/f5mU=
=dH0Z
-----END PGP SIGNATURE-----
-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
Nfsen-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
