-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hi Adrian,
First upgrade to 1.3 there have been some bugs fixed between your snapshot and
1.3
- --On February 18, 2008 11:20:40 +0200 Adrian Popa <[EMAIL PROTECTED]> wrote:
| Hello everybody!
|
| I've been having these problems with nfsen for about a week now... For some
| strange reason my /data partition (where the nfcapd files are stored) keeps
| filling up and this triggers a fill-up of my /var partition (where my logs
| reside).
|
|
| Feb 17 21:23:36 localhost /usr/local/bin/nfcapd[20565]: Failed to write
| output buffer to disk: 'No space left on device'
| Feb 17 21:23:36 localhost /usr/local/bin/nfcapd[20589]: Failed to write
| output buffer to disk: 'No space left on device'
|
| If I do a manual cleanup (remove old files), everything is ok - for a while.
| I don't do a profile rebuild, but it seems to keep the set threshold on my
| /data partition to 92% usage. Unfortunatelly from time to time it jumps to
| 100% usage and after that /var fills up.
|
| I have created a script that will automatically erase old files from /data
| and from /var, but I'm not sure if it's enough. Do I have to do something
| else to get it to accurately rotate nfcapd files? Do I have to set the limit
| lower (to 85% maybe)? The current setup has worked without problems for
| almost a year, so I don't know why this is happening...
Don't delete files manually! The more you delete manually the more wrong you
get.
If you did delete by hand you must rebuild the profiles affected otherwise your
profile size gets counted wrong. In 1.3 you can safely rebuild the profiles,
without
loosing any data. Let NfSen expire the files! The safest is stop NfSen
completely
rebuild the affected profiles and restart NfSen. You may also forcibly expire
the data
./nfsen -X and rebuild it afterwards ./nfsen -r
It's hard to tell, what really fills your disk. Finding the right limit is a
matter
of disk size and expected data volume. There is no general recommendation such
as 85%
or so.
- Peter
|
| I'm running nfsen snapshot-20070110
|
| Thank you!
- --
_______ SWITCH - The Swiss Education and Research Network ______
Peter Haag, Security Engineer, Member of SWITCH CERT
PGP fingerprint: D9 31 D5 83 03 95 68 BA FB 84 CA 94 AB FC 5D D7
SWITCH, Werdstrasse 2, P.O. Box, CH-8021 Zurich, Switzerland
E-mail: [EMAIL PROTECTED] Web: http://www.switch.ch/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (Darwin)
iQCVAwUBR7l47P5AbZRALNr/AQLalwP9G3/xeoBbd9kV0QAlIxExBtZPgGSDA+fI
zpxHxJLgTPzWymYCQkABEqhORVNMyCrGF1d8/swt3Q+ziQcgbZwE0Nm2CK49maol
fmTy47rndJBZ24I792VxYHq0qrqJ5P6XmQHRA9ctNY0y8BEn0iSb3vUFm2e+bjJv
bfLu9ZuGSK8=
=jGLG
-----END PGP SIGNATURE-----
-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Nfsen-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
