Hi James,
Please have a look at your syslog daemon log file. I guess nfcapd
does complain for some reason. An nfcapd file is never 0 in size,
even if there are no flows collected. You always ha a header and
stat record. A typical empty nfcapd file is 276 bytes. So there
must be another reason.
- Peter
On 1/23/12 12:18, James Davis wrote:
> (running nfcapd 1.6.5, compiled from source on Debian 6.0.1)
>
> I'm launching nfcapd with the following command line options
>
> nfcapd -P nfcapd.pid -D -t 300 -w -l /var/netflow -p 49500
>
> but most of the files created are empty and have 0 size. From this
> morning for example:
>
> -rw-r--r-- 1 root root 0 Jan 23 06:00 nfcapd.201201230555
> -rw-r--r-- 1 root root 0 Jan 23 06:05 nfcapd.201201230600
> -rw-r--r-- 1 root root 0 Jan 23 06:10 nfcapd.201201230605
> -rw-r--r-- 1 root root 0 Jan 23 06:15 nfcapd.201201230610
> -rw-r--r-- 1 root root 0 Jan 23 06:20 nfcapd.201201230615
> -rw-r--r-- 1 root root 0 Jan 23 06:25 nfcapd.201201230620
> -rw-r--r-- 1 root root 655360 Jan 23 06:30 nfcapd.201201230625
> -rw-r--r-- 1 root root 0 Jan 23 06:35 nfcapd.201201230630
> -rw-r--r-- 1 root root 0 Jan 23 06:40 nfcapd.201201230635
> -rw-r--r-- 1 root root 0 Jan 23 06:45 nfcapd.201201230640
> -rw-r--r-- 1 root root 0 Jan 23 06:50 nfcapd.201201230645
> -rw-r--r-- 1 root root 0 Jan 23 06:55 nfcapd.201201230650
> -rw-r--r-- 1 root root 0 Jan 23 07:00 nfcapd.201201230655
>
> tcpdump shows a handful of UDP packets arriving every second, so I
> don't think it's a problem with the data not arriving at the
> collector. Any suggestions as to how I debug this further?
>
> Regards,
>
> James
>
>
> JANET(UK) is a trading name of The JNT Association, a company limited
> by guarantee which is registered in England under No. 2881024
> and whose Registered Office is at Lumen House, Library Avenue,
> Harwell Oxford, Didcot, Oxfordshire. OX11 0SG
>
>
> ------------------------------------------------------------------------------
> Try before you buy = See our experts in action!
> The most comprehensive online learning library for Microsoft developers
> is just $99.99! Visual Studio, SharePoint, SQL - plus HTML5, CSS3, MVC3,
> Metro Style Apps, more. Free future releases when you subscribe now!
> http://p.sf.net/sfu/learndevnow-dev2
> _______________________________________________
> Nfsen-discuss mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
--
--
Be nice to your netflow data
------------------------------------------------------------------------------
Try before you buy = See our experts in action!
The most comprehensive online learning library for Microsoft developers
is just $99.99! Visual Studio, SharePoint, SQL - plus HTML5, CSS3, MVC3,
Metro Style Apps, more. Free future releases when you subscribe now!
http://p.sf.net/sfu/learndevnow-dev2
_______________________________________________
Nfsen-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
