I ran into a similar problem with the filtes for inif/outif. Change your
filters so that you have spaces between dstnet like this:
(dst net 193.224.96.0/24 and dst port 80) or (src net 193.224.96.0/24 and
src port 80)
Cheers!
On Thu, Apr 17, 2008 at 2:48 PM, Kiss Gabor (Bitman) <[EMAIL PROTECTED]>
wrote:
> > However I found that other continous profiles are stopped.
> > no more nfcapd.* files are collected but every 5 minutes an
> > nfprofile.* file is created:
>
> Strace shows, that nfprofile process dies:
>
> 7454
>
> open("/usr/local/nfsen/profiles/./MTA-SMTP/c6513/nfprofile.7454",O_RDWR|O_CREAT|O_TRUNC|O_LARGEFILE,
> 0644) = 3
> 7454 write(3,"\f\245\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"...,
> 276) = 276
> 7454 chdir("/usr/local/nfsen/profiles/./MTAK-HTTP/c6513") = 0
> 7454
>
> stat64("/usr/local/nfsen/profiles/./MTAK-HTTP/c6513-filter.txt",{st_mode=S_IFREG|0644,
> st_size=82, ...}) = 0
> 7454
>
> open("/usr/local/nfsen/profiles/./MTAK-HTTP/c6513-filter.txt",O_RDONLY|O_LARGEFILE)
> = 4
> 7454 read(4, "(dstnet 193.224.96.0/24 and dstp"..., 82) = 82
> 7454 close(4) = 0
> 7454 write(2, "line 1: syntax error at \'dstnet\'"..., 33) = 33
> 7454 write(1, "Process line \'.#MTA-SMTP#2#c6513"..., 527) = 527
> 7454 exit_group(254) = ?
>
> Unfortunately stderr of nfprofile is simply discarded.
> (This is why I could find the root of the problem so far.)
>
> File /usr/local/nfsen/profiles/./MTAK-HTTP/c6513-filter.txt contains this:
>
> (dstnet 193.224.96.0/24 and dstport 80) or (srcnet 193.224.96.0/24 and
> srcport 80)
>
> This filter was created under previuos version of nfsen and worked well
> till the upgrade. Did the syntax of filters change?
>
> Gabor
>
> -------------------------------------------------------------------------
> This SF.net email is sponsored by the 2008 JavaOne(SM) Conference
> Don't miss this year's exciting event. There's still time to save $100.
> Use priority code J8TL2D2.
>
> http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone
> _______________________________________________
> Nfsen-discuss mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
>
-------------------------------------------------------------------------
This SF.net email is sponsored by the 2008 JavaOne(SM) Conference
Don't miss this year's exciting event. There's still time to save $100.
Use priority code J8TL2D2.
http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone
_______________________________________________
Nfsen-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
