Hi Peter, Thanks for the reply. So it sounds like renaming the flow source to match the Ident string, and thus the directory name, would solve this. It didn't help, still having the same issue. In your suggestion of changing the Ident string (nfdump -i <newident>), what should I change it to? Is there a filter setting I need to make in defining the profile?
Steve -----Original Message----- From: Peter Haag [mailto:[email protected]] Sent: Tuesday, September 28, 2010 3:57 AM To: SOLOMON, STEVEN J (ATTLABS) Cc: [email protected] Subject: Re: [Nfsen-discuss] Profile Graphs Empty Hi Steve, Profiles are filtered according the flow source. Each flow file contains an ident string, which identifies the source ( see nfdump -I <file> ). This strings is also used to filter the flows for profiling. If you rename the flow source later on ( e.g. by renaming the directory ), this ident string points to the old name. Therefore you would need to change this string too. ( nfdump -i <newident> -f <file> ) - Peter On 9/27/10 23:18, SOLOMON, STEVEN J (ATTLABS) wrote: > > > I am hoping you can offer me some clues since I am stuck with the issue > of empty profile graphs. > > In our installation we have netflow data stored in /data/nfdump, > organized by date, for example > > lznsun02-836# pwd > > /data/nfdump/2010-09-27 > > -rw-r--r-- 1 netman webservd 2290 Sep 27 20:40 > nfcapd.201009272035 > > -rw-r--r-- 1 netman webservd 2322 Sep 27 20:45 > nfcapd.201009272040 > > -rw-r--r-- 1 netman webservd 2312 Sep 27 20:50 > nfcapd.201009272045 > > -rw-r--r-- 1 netman webservd 2438 Sep 27 20:55 > nfcapd.201009272050 > > -rw-r--r-- 1 netman webservd 2337 Sep 27 21:00 > nfcapd.201009272055 > > -rw-r--r-- 1 netman webservd 2345 Sep 27 21:05 > nfcapd.201009272100 > > > > We configured Nfsen to run without a collector, but with its live data > source set to point to the /data/nfdump location, as follows: > > lznsun02-859# pwd > > /data/nfsen/profiles-data/live > > lznsun02-860# ls -l > > total 4 > > lrwxrwxrwx 1 root other 12 Sep 27 21:10 cce -> > /data/nfdump > > > > > > This works fine , for the live configuration, I see the graphs created > by NFsen represent the flows under /data/nfdump, and are updated > regularly. > > > > The problem is with profiles. When I create a profile of anytime, and > specify a time duration for which flows exist in the nfdump data, the > data directory created when I set up the profile only contains nfcapd > files that contain no flows. For example: > > > > lznsun02-872# pwd > > /data/nfsen/profiles-data/test3/cce/2009-11-09 > > lznsun02-869# ls -l > > total 576 > > -rw-r--r-- 1 netman webservd 276 Sep 27 20:59 > nfcapd.200911090000 > > -rw-r--r-- 1 netman webservd 276 Sep 27 20:59 > nfcapd.200911090005 > > -rw-r--r-- 1 netman webservd 276 Sep 27 20:59 > nfcapd.200911090010 > > -rw-r--r-- 1 netman webservd 276 Sep 27 20:59 > nfcapd.200911090015 > > -rw-r--r-- 1 netman webservd 276 Sep 27 20:59 > nfcapd.200911090020 > > ... > > -rw-r--r-- 1 netman webservd 323 Sep 27 20:59 > nfcapd.200911092350 > > -rw-r--r-- 1 netman webservd 323 Sep 27 20:59 > nfcapd.200911092355 > > > > > > The graphs are created for the profile, but they are all empty. > > > > I cannot figure out why it doesn't take the same nfcapd data that the > live data gets from the pointer /data/nfdump location. > > > > I have tried rebuilding and reinstalling everything on my system: nfdump > (and configured with -enable-nfprofile option), rrdtool, and nfsen. > I enabled debug logging and see the log messages from my profile > creation but there are not any clues about what is going wrong. Your > advice or suggestions on what I should try next would be greatly > appreciated! This is a Solaris 10 server. > > > > Thank you, > > Steve > > > > > > > > ------------------------------------------------------------------------ ------ > Start uncovering the many advantages of virtual appliances > and start using them to simplify application deployment and > accelerate your shift to cloud computing. > http://p.sf.net/sfu/novell-sfdev2dev > > > > _______________________________________________ > Nfsen-discuss mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/nfsen-discuss -- -- Be nice to your netflow data ------------------------------------------------------------------------------ Start uncovering the many advantages of virtual appliances and start using them to simplify application deployment and accelerate your shift to cloud computing. http://p.sf.net/sfu/novell-sfdev2dev _______________________________________________ Nfsen-discuss mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
