Thanks for the fix. I will check that and apply it for the next release.
Many thanks
- Peter
On 25/1/11 4:03 PM, Vargas-DellaCasa, Guillermo wrote:
> Hi,
>
> I ran into the same problem trying to mix sflow and netflow sources. Running
> nfsen 1.3.5 and nfdump 1.6.2.
>
> I saw your posting on the list but no reply. I investigated myself. I think I
> fix it, so I'm sharing. I fixed by modifying the file libexec/NfSenRC.pm.
> There was a closing bracket on line 64 that I think was misplaced and should
> have been on line 73.
>
> Here is how it was originally (starting at line 60):
> foreach my $source ( sort keys %NfConf::sources ) {
> my $_port = $NfConf::sources{$source}{'port'};
> if ( $_port == $port ) {
> push @SourceList, $source;
> }
> my $_type = exists $NfConf::sources{$source}{'type'} ?
> $NfConf::sources{$source}{'type'}: 'netflow';
> if ( defined $type ) {
> if ( $type ne $_type ) {
> print "Can not start different type '$type'
> and '$_type' on same port!\n";
> return;
> }
> } else {
> $type = $_type;
> }
> }
>
> And here is how I move the bracket:
> foreach my $source ( sort keys %NfConf::sources ) {
> my $_port = $NfConf::sources{$source}{'port'};
> if ( $_port == $port ) {
> push @SourceList, $source;
> my $_type = exists $NfConf::sources{$source}{'type'} ?
> $NfConf::sources{$source}{'type'}: 'netflow';
> if ( defined $type ) {
> if ( $type ne $_type ) {
> print "Can not start different type '$type'
> and '$_type' on same port!\n";
> return;
> }
> } else {
> $type = $_type;
> }
> }
> }
>
> After that it worked fine. I can capture sflow sources and netflow sources
> now (each in different ports). I am also able to have multiples sflow source
> on the same port. So the above change does not break that functionality
> (which I think this foreach is for).
>
> Additional note: Although I think the change above is appropriate I should
> say that I haven't been able to trigger the error message after the change.
> If I specify two sources on the same port, one with netflow and another with
> sflow the error gets caught before reaching this part of the code (I think
> when NfSources is parsed before calling the StartCollector routine). Also, I
> should point out it is the first time I'm looking at the code (just installed
> nfsen and ran into the problem) so these are the first impressions of a nfsen
> newbie.
>
>
> G.
>
> Guillermo Vargas-Dellacasa
> Computer Operations Manager
> North Hunterdon-Voorhees Regional High School District
> (908) 713-4162
> [email protected]
>
>
> With an older version of nfsen (1.3) I was able to mix netflow and sflow
> sources with this config:
>
> %sources = (
> 'sv3-edge-1' => { 'port' => '6669', 'col' => '#000033', 'type' =>
> 'sflow' },
> 'sv3-edge-2' => { 'port' => '6670', 'col' => '#6600CC', 'type' =>
> 'sflow' },
> 'sv3-peer-1' => { 'port' => '6671', 'col' => '#FFFF00', 'type' =>
> 'sflow' },
> 'dc4-peer-1' => { 'port' => '6672', 'col' => '#CC6600', 'type' =>
> 'sflow' },
> 'dc4-edge-1' => { 'port' => '6673', 'col' => '#0066CC', 'type' =>
> 'netflow'},
> 'dc4-edge-2' => { 'port' => '6674', 'col' => '#006600', 'type' =>
> 'netflow'},
>
> );
>
> since upgrading to 1.3.5 however (and nfdump 1.6), nfsen won't start the
> collectors with this error:
>
> Can not start different type 'netflow' and 'sflow' on same port!
> Can not start different type 'netflow' and 'sflow' on same port!
> Can not start different type 'netflow' and 'sflow' on same port!
> Can not start different type 'netflow' and 'sflow' on same port!
> Can not start different type 'netflow' and 'sflow' on same port!
> Can not start different type 'netflow' and 'sflow' on same port!
>
> If I move the type to sflow for everything or netflow for everything, it
> seems to start, though, naturally, it won't work since some of my sources
> are sflow, some are netflow. Any ideas?
>
>
> -James
>
> --
> James Kelty
> Lead Network Engineer
>
> "Clams are eeeeeeeeevil...."
> - Maisie K. Age 3
>
>
>
>
>
>
> ------------------------------------------------------------------------------
> Special Offer-- Download ArcSight Logger for FREE (a $49 USD value)!
> Finally, a world-class log management solution at an even better price-free!
> Download using promo code Free_Logger_4_Dev2Dev. Offer expires
> February 28th, so secure your free ArcSight Logger TODAY!
> http://p.sf.net/sfu/arcsight-sfd2d
>
>
>
> _______________________________________________
> Nfsen-discuss mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
--
Be nice to your netflow data. Use NfSen and nfdump :)
------------------------------------------------------------------------------
Special Offer-- Download ArcSight Logger for FREE (a $49 USD value)!
Finally, a world-class log management solution at an even better price-free!
Download using promo code Free_Logger_4_Dev2Dev. Offer expires
February 28th, so secure your free ArcSight Logger TODAY!
http://p.sf.net/sfu/arcsight-sfd2d
_______________________________________________
Nfsen-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
