-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- --On March 12, 2008 16:18:07 -0700 Chris Waters <[EMAIL PROTECTED]> wrote:
| OK, it actually is expiring the data. I am wondering if the methodolgy
| for expiration changed in recent versions. Seems to me that previously,
| it was deleting data in a 1 for 1 fashion before. i.e. every 5 minutes
There was no change in expiring the data. Whether or not data is expired
depends on the limits, the watermark as well as the disk size and the amount
of data coming in every 5min. It is therefore perfectly possible, that data
gets expired every 5min, if any of the parameters are tight enough.
| the oldest entry 30 days ago would go away. Now it seems that based on
| the tstart time(I know this because I saw the change on the disk
| monitoring at that time), it will delete all data older than 30 days all
| at once. Did that make sense? I am really just trying to figure out
| what to expect now that I have upgraded.
No - deleting the oldest 30 days is not the same as lifetime 30days!
Assume you have data for 31 days. In your terms 1 day would be left after
deleting data. With lifetime 30 days ( - watermark ) 30 days exists after
deleting old data. Therefore the start point for deleting data is always
tstart - the oldest timeslot available.
|
| Here's the profile info today. It expired 8GB. The tstart changed from
| Feb 11 to Feb 14 overnight....something is missing here, it jumped 3
| days overnight were I would have expected to see Feb 12 as the new
| tstart.
That's what you can define with the waterwark. Assume you have a size limit
of 100MB and a watermark of 90%. Expiring data starts when the size is over
the limit of 100MB. It will delete data down to 90% of 100MB = 90MB.
So the data size will oscillate between 90MB and 100MB. If you have lifetime
limits the same applies here: 30days are 720h. 90% is 648h. So your data
oscillates between 648h and 720h.
The oscillation is mostly given by the level of the watermark you define in
nfsen.conf.
Hope this helps
- Peter
|
| name live
| group (nogroup)
| tcreate Tue Mar 27 16:20:00 2007
| tstart Thu Feb 14 10:10:00 2008
| tend Wed Mar 12 15:55:00 2008
| updated Wed Mar 12 15:55:00 2008
| expire 30 days 0 hours
| size 60.2 GB
| maxsize 0
| type live
| locked 0
| status OK
| version 130
|
| Thanks.
|
| Chris Waters
| Technology Services - Network Group
| JELD-WEN, Inc.
| Information Systems
| [EMAIL PROTECTED]
|
| -----Original Message-----
| From: [EMAIL PROTECTED]
| [mailto:[EMAIL PROTECTED] On Behalf Of Chris
| Waters
| Sent: Wednesday, March 12, 2008 9:06 AM
| To: Peter Haag; [email protected]
| Subject: Re: [Nfsen-discuss] Profile Data Not Expiring
|
| Actually I didn't recompress the old ones by hand. I decided to let
| them naturally expire which means in a month they will all be
| compressed. I will keep an eye on this.
|
| Thanks Peter.
|
| -----Original Message-----
| From: Peter Haag [mailto:[EMAIL PROTECTED]
| Sent: Wednesday, March 12, 2008 8:58 AM
| To: Chris Waters; [email protected]
| Subject: Re: [Nfsen-discuss] Profile Data Not Expiring
|
| -----BEGIN PGP SIGNED MESSAGE-----
| Hash: SHA1
|
|
|
| - --On March 12, 2008 8:46:44 -0700 Chris Waters <[EMAIL PROTECTED]>
| wrote:
|
| | Here is the output with just the first few lines of channels:
| |
| | # /usr/local/svn/nfsen/bin/nfsen -l live
| | name live
| | group (nogroup)
| | tcreate Tue Mar 27 16:20:00 2007
| | tstart Mon Feb 11 11:10:00 2008
| | tend Wed Mar 12 08:30:00 2008
| | updated Wed Mar 12 08:30:00 2008
| | expire 30 days 0 hours
| | size 68.6 GB
| | maxsize 0
| | type live
| | locked 0
| | status OK
| | version 130
| | channel vca-gan-wd-1 sign: + colour: #009933 order: 1
| | sourcelist: vca-gan-wd-1 Files: 8532 Size: 43110400
| | channel vca-ott-wd-1 sign: + colour: #009933 order: 2
| | sourcelist: vca-ott-wd-1 Files: 8533 Size: 37076992
| | channel vca-sap-wd-1 sign: + colour: #009933 order: 3
| | sourcelist: vca-sap-wd-1 Files: 8532 Size: 911118336
| |
| | Isn't the tstart value supposed to change at every expire? I believe
| | it has remained the same since I turned on compression.
|
| Well - it changes only, if there are files to expire. Feb 11 to Mar 12
| is pretty much 30days. So it seams reasonable to me.
| NfSen swings within the watermarks, but expires only, when lifetime or
| size exceeds the given limit. So it is pretty normal, that NfSen does
| not expire as long as the limits are not reached.
|
| Please not: If you compressed older files by hand/shell script you must
| rebuild the profile, otherwise NfSen does not know, that you manipulated
| the files by hand. Run ./nfsen -r live
|
| - Peter
| |
| | Thanks for the help.
| |
| | Chris Waters
| | Technology Services - Network Group
| | JELD-WEN, Inc.
| | Information Systems
| | [EMAIL PROTECTED]
| |
| | -----Original Message-----
| | From: Peter Haag [mailto:[EMAIL PROTECTED]
| | Sent: Wednesday, March 12, 2008 5:25 AM
| | To: Chris Waters; [email protected]
| | Subject: Re: [Nfsen-discuss] Profile Data Not Expiring
| |
| | -----BEGIN PGP SIGNED MESSAGE-----
| | Hash: SHA1
| |
| |
| |
| | - --On March 11, 2008 17:18:05 -0700 Chris Waters
| | <[EMAIL PROTECTED]>
| | wrote:
| |
| | | Quickstats:
| | | nfsen from svn version 24
| | | nfdump 1.5.7
| | | Centos 5.1 x86_64
| | |
| | | After my recent upgrade, it appears that the expiry is not working
| | | for
| |
| | | my live profile. If I look through the logs, I see an odd entry for
|
| | | the low water mark, note the
| | | "%%":
| | |
| | | [EMAIL PROTECTED] etc]# tail -f /var/log/messages | grep nfsen Mar 11
| | | 17:05:16 netflow nfsen[21837]: 3 channels/alerts to profile Mar 11
| | | 17:05:16 netflow nfsen[21837]: Update profile live in group .
| | | Mar 11 17:05:27 netflow nfsen[21837]: Update profile VPN in group
| | | VPN Mar 11 17:05:27 netflow nfsen[21837]: Run expire at Tue Mar 11
| | | 17:05:00
| | | 2008
| | | Mar 11 17:05:27 netflow nfsen[21837]: Expire profile live group .
| | | low water mark: 90%% Mar 11 17:05:35 netflow nfsen[21837]: End
| | | expire at Tue Mar 11 17:05:00
| | | 2008
| | |
| | | The stats for the profile show that the start time is not changing.
| | |
| | | Any quick tips on where to look to see what's going on?
| |
| | Well - according the log, there is nothing to expire.
| | you check on the command line: ./nfsen -l live
| |
| |
| | You see the profile stats including its limits.
| |
| | What does it say?
| |
| | - Peter
| |
| | |
| | | Thanks.
| | |
| | |
| | | Chris Waters
| | |
| | | Technology Services - Networks Group
| | |
| | |
| | |
| | | JELD-WEN, inc.
| | |
| | | Information Systems
| | |
| | | [EMAIL PROTECTED]
| | |
| | | RELIABILITY for real life(r)
| | |
| | | This correspondence is for the named person's use only. It may
| | | contain
| |
| | | confidential or legally privileged information and is intended
| | | solely for the named addressee. If you receive this correspondence
| | | in error, please notify the sender and delete it from your system.
| | | You must not disclose, copy or rely on any part of this
| | | correspondence if you are not the intended recipient.
| | |
| | |
| |
| |
| |
| | - --
| | _______ SWITCH - The Swiss Education and Research Network ______ Peter
|
| | Haag, Security Engineer, Member of SWITCH CERT PGP fingerprint: D9
| | 31
| | D5 83 03 95 68 BA FB 84 CA 94 AB FC 5D D7
| | SWITCH, Werdstrasse 2, P.O. Box, CH-8021 Zurich, Switzerland
| | E-mail: [EMAIL PROTECTED] Web: http://www.switch.ch/ -----BEGIN PGP
| | SIGNATURE-----
| | Version: GnuPG v1.4.3 (Darwin)
| |
| | iQCVAwUBR9fLof5AbZRALNr/AQL40AQAl/jJglhbBfgr0MFs4P7QEq6ZnXg+3dj8
| | SWotp7zHGkDAiPahS6aludC5Inn8OPULM5goStVEgbFHpSlKGg0sbBRrzO5XFUIt
| | /Fa/GY8GqoKdHWf5JSV2JI6yugDYeSnxVdiXE3FO37xzDUsihuzSokMq0zxS9k1W
| | m+pQy8QhpEQ=
| | =qoIN
| | -----END PGP SIGNATURE-----
| |
| |
| | ----------------------------------------------------------------------
| | --- This SF.net email is sponsored by: Microsoft Defy all challenges.
| | Microsoft(R) Visual Studio 2008.
| | http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
| | _______________________________________________
| | Nfsen-discuss mailing list
| | [email protected]
| | https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
|
|
|
| - --
| _______ SWITCH - The Swiss Education and Research Network ______ Peter
| Haag, Security Engineer, Member of SWITCH CERT PGP fingerprint: D9 31
| D5 83 03 95 68 BA FB 84 CA 94 AB FC 5D D7
| SWITCH, Werdstrasse 2, P.O. Box, CH-8021 Zurich, Switzerland
| E-mail: [EMAIL PROTECTED] Web: http://www.switch.ch/ -----BEGIN PGP
| SIGNATURE-----
| Version: GnuPG v1.4.3 (Darwin)
|
| iQCVAwUBR9f9l/5AbZRALNr/AQKYqgP+Pogs8mdeI+8qxpoE6QsnCBfNOJcHA/uk
| LOwxu+58CEF9QIO6AYGQt3atkU/dSbAbOO0BME0ruHqxyUFLNnCIqbFYMNOdD9+k
| CF75OoSh8/UTsbLW8VQbReEWESj8b3JwZudlxD452oiSiY1w/V2VN9wKHuE5w09h
| 8MPz+FhDbRo=
| =0WBN
| -----END PGP SIGNATURE-----
|
|
| ------------------------------------------------------------------------
| -
| This SF.net email is sponsored by: Microsoft Defy all challenges.
| Microsoft(R) Visual Studio 2008.
| http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
| _______________________________________________
| Nfsen-discuss mailing list
| [email protected]
| https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
|
| -------------------------------------------------------------------------
| This SF.net email is sponsored by: Microsoft
| Defy all challenges. Microsoft(R) Visual Studio 2008.
| http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
| _______________________________________________
| Nfsen-discuss mailing list
| [email protected]
| https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
- --
_______ SWITCH - The Swiss Education and Research Network ______
Peter Haag, Security Engineer, Member of SWITCH CERT
PGP fingerprint: D9 31 D5 83 03 95 68 BA FB 84 CA 94 AB FC 5D D7
SWITCH, Werdstrasse 2, P.O. Box, CH-8021 Zurich, Switzerland
E-mail: [EMAIL PROTECTED] Web: http://www.switch.ch/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (Darwin)
iQCVAwUBR9javP5AbZRALNr/AQLP7wP+NIotOVm+F8rgkFMWDJQBHV1Wg+YsNOH0
KBhDGLmeHvJ3+cN3JA6EC0I7ne6qglkB9/GUokUWnUGMgExloLzGgtHBX3aKK2RM
VmA7pvsmkwYE2rLMklpC9EHQtg/2gW0rhvpsTa2xaoaBNH29/Ymj28lNetg5I6iu
AnjmGyWfpqc=
=rJLq
-----END PGP SIGNATURE-----
-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Nfsen-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
