-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- --On August 20, 2007 21:56:54 -0400 "Brown, Robin" <[EMAIL PROTECTED]> wrote:
| I am now experiencing this issue. New install of:
|
| nfdump: Version: snapshot-20070808 $LastChangedDate: 2007-03-06 09:49:26
| +0100 (Tue, 06 Mar 2007) $
| $Id: nfdump.c 88 2007-03-06 08:49:26Z peter $
|
| ./nfsen: 1.3b-20070720 $Id: nfsen 18 2007-07-20 12:33:25Z phaag $
|
| Profiles other than live are not updated. The relevant directories and
| rrd files get created but are never updated. I removed all special
| characters from the profile names, still no updating.
|
| Any advice?
Make sure, you have compiled nfprofile with --enable-nfprofile, when building
nfdump.
Otherwise it's not built and an old version of nfprofile stays in place, which
does
not work. Make also sure, that it's linked correctly, and that the loader of
your OS
find the appropriate rrd library, which is often not in a standard search path.
You
may check that with 'nfprofile -V' to see of the binary can be run.
- Peter
|
| -Robin
|
|
| -----Original Message-----
| From: [EMAIL PROTECTED]
| [mailto:[EMAIL PROTECTED] On Behalf Of Peter
| Haag
| Sent: Monday, August 06, 2007 4:28 AM
| To: Felix Schueren; [email protected];
| [EMAIL PROTECTED]
| Subject: Re: [Nfsen-discuss] Problems with profiles other than live
|
| -----BEGIN PGP SIGNED MESSAGE-----
| Hash: SHA1
|
| Felix, Chris,
| For a quick fix: Apply the patch below to the file scanner.l and
| recompile nfdump.
|
| - Peter
|
|
| - --- scanner.l.orig 2007-08-06 10:23:25.000000000 +0200
| +++ scanner.l 2007-08-06 10:23:34.000000000 +0200
| @@ -84,7 +84,7 @@
| yylval.s = strdup(yytext);
| return IPSTRING;
| }
| - -ident[ \t]+[a-zA-Z0-9_]+ {
| +ident[ \t]+[a-zA-Z0-9_\-]+ {
| char *p = &(yytext[5]);
| while ( *p == ' ' || *p == '\t'
| ) p++;
| yylval.s = strdup(p);
|
|
| - --On August 2, 2007 13:51:55 +0200 Felix Schueren
| <[EMAIL PROTECTED]> wrote:
|
| | I ran into the same problem as Chris Waters did - nfsen works nicely,
| | any profile other than default/live does get created but never
| receives
| | any data. After debugging this for a while, it appears that nfprofile
| | does not handle channel_sourcelist entries with dashes ("-"):
| |
| |
| | [EMAIL PROTECTED]:/usr/src/nfdump-snapshot-20070312# nfprofile -I -p
| | /var/flows/nfsen/profiles-data -P /var/flows/nfsen/profiles-stat -S 1
| -M
| | /var/flows/nfsen/profiles-data/live/jc-blue_cgn1:jcore1_cgn2 -r
| | nfcapd.200708021150
| | Blubb#Test-HTTP#2#Egress#jc-blue_cgn1|jcore1_cgn2
| | Process line 'Blubb#Test-HTTP#2#Egress#jc-blue_cgn1|jcore1_cgn2
| | '
| | Setup channel 'Egress' in profile 'Test-HTTP' group 'Blubb',
| channellist
| | 'jc-blue_cgn1|jcore1_cgn2'
| | Filter: (ident jc-blue_cgn1 or ident jcore1_cgn2) and (port 80)
| | line 1: syntax error at '-'
| |
| | creating a profile with just "jcore1.cgn2" works fine. I could see
| that
| | Chris had router ident names like "rus-kla-ops-1" so that's probably
| the
| | same issue.
| |
| | I haven't been able to figure out the exact problem within
| nfprofile.c,
| | somebody with better C skills needs to do that :p
| |
| | Oh, and also nfsend should probably not fail silently when this
| happens.
| |
| | kind regards,
| |
| | Felix
| |
| | --
| | Felix Schueren, Head of NOC
| |
| | mailto:[EMAIL PROTECTED]
| |
| | Host Europe GmbH - http://www.hosteurope.de
| | Welserstrasse 14 - D-51149 Koeln - Germany
| | Telefon (0800) 4678387 - Telefax (01805) 663233
| | HRB 28495 Amtsgericht Koeln - UST ID DE187370678
| | Geschaeftsfuehrer U. Braun - M. Read - S. Porter
| |
| | Fuer diese Nachricht gilt: http://www.hosteurope.de/disclaimer.html
| |
| |
| ------------------------------------------------------------------------
| -
| | This SF.net email is sponsored by: Splunk Inc.
| | Still grepping through log files to find problems? Stop.
| | Now Search log events and configuration files using AJAX and a
| browser.
| | Download your FREE copy of Splunk now >> http://get.splunk.com/
| | _______________________________________________
| | Nfsen-discuss mailing list
| | [email protected]
| | https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
|
|
|
| - --
| _______ SWITCH - The Swiss Education and Research Network ______
| Peter Haag, Security Engineer, Member of SWITCH CERT
| PGP fingerprint: D9 31 D5 83 03 95 68 BA FB 84 CA 94 AB FC 5D D7
| SWITCH, Werdstrasse 2, P.O. Box, CH-8021 Zurich, Switzerland
| E-mail: [EMAIL PROTECTED] Web: http://www.switch.ch/
| -----BEGIN PGP SIGNATURE-----
| Version: GnuPG v1.4.3 (Darwin)
|
| iQCVAwUBRrbbgf5AbZRALNr/AQKpdAP/c63Iq2f3jkbHJRapjcfoOSkp+o3Yszdo
| EbNqdRurszkO3vBQQog3NxzWQHNZDHAj/VwYaSakM+5IKRJ+LXsjo+GGLoZMUt0w
| PIeXqCQ2tWGDkMhxOKGS4Dm7304A6s+WMsi6JAdhUeaFXk7sDFUSnlaQH4rAZiyh
| wrOguu+REeE=
| =50cZ
| -----END PGP SIGNATURE-----
|
|
| ------------------------------------------------------------------------
| -
| This SF.net email is sponsored by: Splunk Inc.
| Still grepping through log files to find problems? Stop.
| Now Search log events and configuration files using AJAX and a browser.
| Download your FREE copy of Splunk now >> http://get.splunk.com/
| _______________________________________________
| Nfsen-discuss mailing list
| [email protected]
| https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
|
| -------------------------------------------------------------------------
| This SF.net email is sponsored by: Splunk Inc.
| Still grepping through log files to find problems? Stop.
| Now Search log events and configuration files using AJAX and a browser.
| Download your FREE copy of Splunk now >> http://get.splunk.com/
| _______________________________________________
| Nfsen-discuss mailing list
| [email protected]
| https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
- --
_______ SWITCH - The Swiss Education and Research Network ______
Peter Haag, Security Engineer, Member of SWITCH CERT
PGP fingerprint: D9 31 D5 83 03 95 68 BA FB 84 CA 94 AB FC 5D D7
SWITCH, Werdstrasse 2, P.O. Box, CH-8021 Zurich, Switzerland
E-mail: [EMAIL PROTECTED] Web: http://www.switch.ch/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (Darwin)
iQCVAwUBRsqBAf5AbZRALNr/AQInEwQAghBPjlGSaKWn/y2z3g/wP/C9MapCYkXr
cKz2YsDCGBZnpXMaPAlcGBr3cC7kB3y9YMauNnOn4JqOy596jY3rU4ExZxb9DeIT
+cJrROiv7nC9Ye1+MrKRJqu1ui+TpBjdCxXiyXHHD7tz6g37/HobnGDjJWcl1/m0
UISJOkxLYxk=
=r7QK
-----END PGP SIGNATURE-----
-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
Nfsen-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
