Thank you for your reply. I will rebuild my profiles tomorrow morning and
keep monitoring the situation... It seems the partition overflows over the
weekend, so I'll keep an eye on it. I will upgrade to 1.3, but I don't know
exactly when...
I'm not currently connected to the nfsen box, but what does nfsen -X do? Can
I specify a time range (expire files older than x?). Maybe you'll consider
it as a feature request... :)
On Feb 18, 2008 2:24 PM, Peter Haag <[EMAIL PROTECTED]> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Hi Adrian,
> First upgrade to 1.3 there have been some bugs fixed between your snapshot
> and 1.3
>
> - --On February 18, 2008 11:20:40 +0200 Adrian Popa <
> [EMAIL PROTECTED]> wrote:
>
> | Hello everybody!
> |
> | I've been having these problems with nfsen for about a week now... For
> some
> | strange reason my /data partition (where the nfcapd files are stored)
> keeps
> | filling up and this triggers a fill-up of my /var partition (where my
> logs
> | reside).
> |
> |
> | Feb 17 21:23:36 localhost /usr/local/bin/nfcapd[20565]: Failed to write
> | output buffer to disk: 'No space left on device'
> | Feb 17 21:23:36 localhost /usr/local/bin/nfcapd[20589]: Failed to write
> | output buffer to disk: 'No space left on device'
> |
> | If I do a manual cleanup (remove old files), everything is ok - for a
> while.
> | I don't do a profile rebuild, but it seems to keep the set threshold on
> my
> | /data partition to 92% usage. Unfortunatelly from time to time it jumps
> to
> | 100% usage and after that /var fills up.
> |
> | I have created a script that will automatically erase old files from
> /data
> | and from /var, but I'm not sure if it's enough. Do I have to do
> something
> | else to get it to accurately rotate nfcapd files? Do I have to set the
> limit
> | lower (to 85% maybe)? The current setup has worked without problems for
> | almost a year, so I don't know why this is happening...
>
> Don't delete files manually! The more you delete manually the more wrong
> you get.
> If you did delete by hand you must rebuild the profiles affected otherwise
> your
> profile size gets counted wrong. In 1.3 you can safely rebuild the
> profiles, without
> loosing any data. Let NfSen expire the files! The safest is stop NfSen
> completely
> rebuild the affected profiles and restart NfSen. You may also forcibly
> expire the data
> ./nfsen -X and rebuild it afterwards ./nfsen -r
>
> It's hard to tell, what really fills your disk. Finding the right limit is
> a matter
> of disk size and expected data volume. There is no general recommendation
> such as 85%
> or so.
>
> - Peter
>
>
> |
> | I'm running nfsen snapshot-20070110
> |
> | Thank you!
>
>
>
> - --
> _______ SWITCH - The Swiss Education and Research Network ______
> Peter Haag, Security Engineer, Member of SWITCH CERT
> PGP fingerprint: D9 31 D5 83 03 95 68 BA FB 84 CA 94 AB FC 5D D7
> SWITCH, Werdstrasse 2, P.O. Box, CH-8021 Zurich, Switzerland
> E-mail: [EMAIL PROTECTED] Web: http://www.switch.ch/
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.3 (Darwin)
>
> iQCVAwUBR7l47P5AbZRALNr/AQLalwP9G3/xeoBbd9kV0QAlIxExBtZPgGSDA+fI
> zpxHxJLgTPzWymYCQkABEqhORVNMyCrGF1d8/swt3Q+ziQcgbZwE0Nm2CK49maol
> fmTy47rndJBZ24I792VxYHq0qrqJ5P6XmQHRA9ctNY0y8BEn0iSb3vUFm2e+bjJv
> bfLu9ZuGSK8=
> =jGLG
> -----END PGP SIGNATURE-----
>
>
-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Nfsen-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
