Steve,
The symptoms you describe seem identical to those I experienced on install.
In our case, we had neglected to link the rrd libs in the ntprofile build
(nfdump). This was necessary for us because they were in a non-standard
location.
--with-rrdpath=[/usr]
When building nfprofile, configure expects to find the
installed rrdtool in /usr with rrd.h in /usr/include and
librrd in /usr/lib
Hope this helps.
Lance Shaw
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Steve
Foley
Sent: Tuesday, September 09, 2008 10:36 AM
To: [email protected]
Subject: [Nfsen-discuss] Profiles causing data processing to halt?
Greetings from a new user. My apologies if this has already been
addressed, but I didnt see anything in the archives and have been
struggling to get things working right (and Im so close!). It looks
like nfsen will do exactly what I want if only I can work this this
problem that I am having:
Im running nfsen 1.3 on a Solaris 10 box. After a little bit of
futzing to get it going (seems the conf.php file still starts with
"<?" and not "<?php", BTW), everything seems to be working reasonably
well with just the live profile. When I create any other profile that
I have tried, the graphs stop updating and the "End" time in the
"Profileinfo" freezes where it is until I remove the profile I
created. The profile I create never gets anything to show on a graph
and has the same start and end time in its "Profileinfo" listing.
Reloading "live" seems to update the start and end times (but not the
graphs of course), but the end time never increases beyond that until
the new profile is removed. Throughout this time, nfcapd seems to keep
working and adding to data files on the disk. Logs seem to be fairly
normal with the exception being this exchange showing up with the
added profile exists:
Sep 8 23:40:15 anfmon <13>Sep 8 23:40:15 nfsen[5319]: Run periodic
at Mon Sep 8 23:40:00 2008
Sep 8 23:40:15 anfmon <13>Sep 8 23:40:15 nfsen[5319]: Prepare
profiling './live'
Sep 8 23:40:15 anfmon <13>Sep 8 23:40:15 nfsen[5319]: Prepare
profiling 'HiSeasNet/SatMex5b2'
Sep 8 23:40:15 anfmon <12>Sep 8 23:40:15 nfsen[5319]: 2 channels/
alerts to profile
Sep 8 23:40:15 anfmon <13>Sep 8 23:40:15 nfsen[5319]: profile opts:
HiSeasNet#SatMex5b2#2#WaltonSmithOut#kuband
Sep 8 23:40:15 anfmon <13>Sep 8 23:40:15 nfsen[5319]: profile opts:
HiSeasNet#SatMex5b2#2#EndeavorOut#kuband
Sep 8 23:40:15 anfmon <13>Sep 8 23:40:15 nfsen[5319]: nfsend: exit
child[18392] Exit: 0, Signal: 9, Core: 0
Sep 8 23:40:15 anfmon <9>Sep 8 23:40:15 nfsen[5319]: nfprofile failed:
Sep 8 23:40:15 anfmon <13>Sep 8 23:40:15 nfsen[5319]: System was: /
opt/netflow/bin/nfprofile -I -t 1220916900 -p /opt/netflow/profiles-
data -P /opt/netflow/profiles-stat -S 5 -M /opt/netflow/profiles-data/
live/kuband -r nfcapd.200809082335
Normally (with no profile) it looks something like:
Sep 5 04:30:15 anfmon <13>Sep 5 04:30:15 nfsen[25768]: Run periodic
at Fri Sep 5 04:30:00 2008
Sep 5 04:30:15 anfmon <13>Sep 5 04:30:15 nfsen[25768]: Prepare
profiling './live'
Sep 5 04:30:15 anfmon <12>Sep 5 04:30:15 nfsen[25768]: 0 channels/
alerts to profile
Sep 5 04:30:15 anfmon <13>Sep 5 04:30:15 nfsen[25768]: No continous
profiles - nothing to profile
Sep 5 04:30:15 anfmon <12>Sep 5 04:30:15 nfsen[25768]: Update
profile live in group .
Sep 5 04:30:15 anfmon <13>Sep 5 04:30:15 nfsen[25768]: Add channel
size 62583808
Sep 5 04:30:15 anfmon <13>Sep 5 04:30:15 nfsen[25768]: Set new
profile size: 62583808
Sep 5 04:30:15 anfmon <13>Sep 5 04:30:15 nfsen[25768]: Add .:live:
200809050425 for plugin processing
I saw a post about filters causing similar problems, but the channel
filters (no filtering on the profile) I have tried are pretty straight
forward and accepted by both nfdump on the command line, as well as
nfsen in the Netflow Processing form. Specifically I have tried
filters of "IN IF 4" and "( DST NET 131.128/16 ) and ( ( OUT IF 14 )
or ( OUT IF 23 ) )". I have also tried both real and shadow profiles
that are continuous.
Ultimately I am trying to graph individual network usage and top
talkers across a couple of router interfaces that handles traffic to
5-10 networks in near real-time (5 min delay is okay, but Id rather
have 1-2 min delay). Id love to see which network destinations are
using what portion of the link. If there is a better way than
filtering channels in a profile, Id love to hear it.
Thanks for any suggestions,
-Steve
-----
Steve Foley
Scripps Institution of Oceanography
[EMAIL PROTECTED], (858) 822-3356
-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great
prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
Nfsen-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
Nfsen-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
