-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hi Bogdan,
It looks like that your nfcapd collector processes can not update the stat
files.
Make sure the UID for nfcapd can write and update the files. Also check the
syslog
daemon message file, as problems are reported there. Make also sure that any
SElinux
policies are set correct if you have them in place.
Let me know about the results
- Peter
- --On March 28, 2008 11:31:34 -0400 Bogdan Dumitriu <[EMAIL PROTECTED]> wrote:
| Hello everybody,
|
| First a bit about our system: Linux 2.6.18-1.2849.fc6 #1 SMP
|
| We tried both the latest stable and beta:
| nfsen: 1.3b-20070824 $Id: nfsen 18 2007-07-20 12:33:25Z phaag $
|
| We have recently started to use nfsen/nfdump and realized it's not
| updating the size of the live profile and filled the whole drive. It's
| strange that all the other profiles are fine. Both the gui and "nfsen -l
| live" show "Size: 0" for the live profile:
|
| [EMAIL PROTECTED] bin]#./nfsen -l live
| name live
| group (nogroup)
| tcreate Fri Mar 28 10:20:00 2008
| tstart Fri Mar 28 10:23:54 2008
| tend Fri Mar 28 11:00:00 2008
| updated Fri Mar 28 11:00:00 2008
| expire 0 hours
| size 0
| maxsize 0
| type live
| locked 0
| status OK
| version 130
| channel pego10k sign: + colour: #0000ff order: 1 sourcelist:
| pego10k ERR Channel info file missing for channel 'pego10k' in 'live'
| Files: 0 Size: 0
|
| even though the live profile is ~800MB:
|
| [EMAIL PROTECTED] bin]# du -bs /data/nfsen/profiles-data/live/
| 904764050 /data/nfsen/profiles-data/live/
|
|
| By default ".nfstat" (channel info in
| $DATADIR/profile-data/live/channel/.nfstat) is empty and it doesn't get
| updated:
|
| Mar 28 10:50:15 brawn nfsen[12577]: Error reading channel stat
| information. Missing key 'first'
|
|
| "nfsen -r live" will regenerate ".nfstat" and "profile.dat" with the
| right info (including the size)
|
| [EMAIL PROTECTED] bin]# ./nfsen -r live
| name live
| group (nogroup)
| tcreate Fri Mar 28 10:20:00 2008
| tstart Fri Mar 28 10:20:00 2008
| tend Fri Mar 28 11:10:00 2008
| updated Fri Mar 28 11:10:00 2008
| expire 0 hours
| size 801.9 MB
| maxsize 0
| type live
| locked 0
| status OK
| version 130
| channel pego10k sign: + colour: #0000ff order: 1 sourcelist:
| pego10k Files: 11 Size: 840855552
|
| [EMAIL PROTECTED] bin]#
| [EMAIL PROTECTED] bin]# cat /data/nfsen/profiles-data/live/pego10k/.nfstat
| first=1206714000
| last=1206717000
| size=840855552
| maxsize=0
| numfiles=11
| lifetime=0
| watermark=0
| status=0
|
|
| But unfortunately they stay that way and it will no longer get updated
| automatically.
|
| Mar 28 11:20:15 brawn nfsen[12981]: Update profile live in group .
| Mar 28 11:20:15 brawn nfsen[12981]: Add channel size 840855552
| Mar 28 11:20:15 brawn nfsen[12981]: Set new profile size: 840855552
|
| Mar 28 11:25:15 brawn nfsen[12981]: Update profile live in group .
| Mar 28 11:25:15 brawn nfsen[12981]: Add channel size 840855552
| Mar 28 11:25:15 brawn nfsen[12981]: Set new profile size: 840855552
|
| ------------------- and so on ----------------------------
|
|
| At the beginning we thought we did something wrong so we tried to
| recompile the whole thing, remove all the channels, re-add the channels,
| expire all the files, add a maxsize to the live profile, remove the max
| size, rebuild the profile, etc. We've tried everything we could have
| thought of! This morning we actually did a new clean install of
| nfse/nfdump on a different machine and, as you can see, the size of the
| live profile still doesn't get updated automatically!
|
| Has anybody else run into this problem? Is this a known bug? Is there a
| fix? Are we doing something wrong?
|
| Thanks,
| Bogdan.
|
| Do you really need to print this email? Help preserve our environment!
Devez-vous vraiment imprimer ce courriel? Pensons a
| l'environnement! __________________________________________________________
|
| The information in this message, including in all attachments, is
confidential or privileged. In the event you have received
| this message in error and are not the intended recipient, you are hereby
advised that any use, copying or reproduction of
| this document is strictly forbidden. Please notify immediately the sender of
this error and destroy this message, including
| its attachments, as the case may be.
| L'information apparaissant dans ce message electronique et dans les documents
qui y sont joints est de nature confidentielle
| ou privilegiee. Si ce message vous est parvenu par erreur et que vous n'en
etes pas le destinataire vise, vous etes par les
| presentes avise que toute utilisation, copie ou distribution de ce message
est strictement interdite. Vous etes donc prie
| d'en informer immediatement l'expediteur et de detruire ce message, ainsi que
les documents qui y sont joints, le cas echeant.
|
| __________________________________________________________
- --
_______ SWITCH - The Swiss Education and Research Network ______
Peter Haag, Security Engineer, Member of SWITCH CERT
PGP fingerprint: D9 31 D5 83 03 95 68 BA FB 84 CA 94 AB FC 5D D7
SWITCH, Werdstrasse 2, P.O. Box, CH-8021 Zurich, Switzerland
E-mail: [EMAIL PROTECTED] Web: http://www.switch.ch/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (Darwin)
iQCVAwUBR/MnPf5AbZRALNr/AQL4xwQAiJkq2hwWVcyLbB9XuVwoJV0DTT/wHyS/
NDmOxKoAjxPnUt79MoceZydwGsyuezsTva0mOudBN904i/3h3L9oH5C+pS70RmFN
PcLLz9IuIVimNw/hp65jzLKvwUvdZt4jAM+TjEpZbvESIRreZ7eSrQ0gmnSyLPrW
cCLZxlBGCkc=
=LhNE
-----END PGP SIGNATURE-----
-------------------------------------------------------------------------
Check out the new SourceForge.net Marketplace.
It's the best place to buy or sell services for
just about anything Open Source.
http://ad.doubleclick.net/clk;164216239;13503038;w?http://sf.net/marketplace
_______________________________________________
Nfsen-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
