Not a full answer but...
On Wed, Dec 14, 2011 at 7:42 PM, Ewald Jenisch <[email protected]> wrote:
> Hi,
>
> For reasons I don't know nfdump/nfsen managed to fill the entire disk
> (I've set a threshold both in size and age of data and this has been
> working for months). Stopping/starting nfsen with the disk full
> condition didn't work since the disk really was completely full - I
> had to kill the nfsen-related processes by hand.
>
> Then I went on ot delete the old data "by hand", i.e.
>
> # cd /var/nfsen/profiles-data/live/<netflow-source>/2011
>
> and "rm -fr" for all directories prior to "12"; in other words
> deleting all data prior to December 2011 for all netflow data sources.
>
>
> Next I re-started nfsen, which in turn also started the corresponding
> nfdump-processes.
>
> However this is where the real mess began:
>
> o) When firing up the web-interface for nfsen it it seems no data is
> coming in, i.e. I don't see anything after the time the disk got full.
>
> o) The graphics displayed go back well beyond the date I deleted the
> corresponding data. To be specific: I deleted all data prior to
> December, but the graphics still show data from November and October.
>
> This is normal behavior. The graphs are stored in RRD files and once you
delete the data, the past information is not re-indexed and re-updated. You
will always see historical data in the RRDs even if the data is not there
anymore.
> o) New data is coming in - at least the files in
> /var/nfsen/profiles-data/live/<netflow-source>/2011/12/14 grow
>
> o) I can't stop nfsen any more: When running "nfsen stop" the nfcapd
> processes seem to stop, but nfsend doesn't stop giving an error message
> like "Process [1007] does not want to terminate!"
>
> The process-list also shows that nfsend is still running
> # ps auxww | grep nf
> www 1007 0.0 0.5 76116 22164 ?? Is 4:43PM 0:00.61
> /usr/local/bin/perl -w /usr/local/bin/nfsend
> www 1008 0.0 0.4 70816 16864 ?? Is 4:43PM 0:00.78
> /usr/local/bin/nfsend-comm (perl)
> .
> .
> .
> www 1217 0.0 0.0 4668 1076 ?? I 4:43PM 0:00.00
> /usr/local/bin/nfexpire -Y -p -e /usr/local/var/nfsen/profiles-data/./live
> -w 90 -s 42949672960 -t 720
>
> (I didn't do a "kill -9" on nfsend though, seemed to harsh to me)
>
> Here is the relevant data about my environment:
>
> FreeBSD 7.4, 64bit
> nfsen 1.3.5 (from "nfsen --version")
> nfcapd 1.6.4
> nfdump 1.6.4
>
>
> So here are my questions:
>
> o) How can I get nfsen display data again? ("manual cleanup"?)
>
> I think you need to rebuild your profiles, otherwise it won't know you
have deleted data and manual expire won't work reliably.
> o) Why is new data not reflected in the web interface - how can I get
> nfsen to display new data?
>
>
> So for the moment nfsen is not operable :-(
>
> Any help is very much appreciated,
> -ewald
>
>
> ------------------------------------------------------------------------------
> Cloud Computing - Latest Buzzword or a Glimpse of the Future?
> This paper surveys cloud computing today: What are the benefits?
> Why are businesses embracing it? What are its payoffs and pitfalls?
> http://www.accelacomm.com/jaw/sdnl/114/51425149/
> _______________________________________________
> Nfsen-discuss mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
>
------------------------------------------------------------------------------
10 Tips for Better Server Consolidation
Server virtualization is being driven by many needs.
But none more important than the need to reduce IT complexity
while improving strategic productivity. Learn More!
http://www.accelacomm.com/jaw/sdnl/114/51507609/
_______________________________________________
Nfsen-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
