Hello guys,
I've installed nfdump (lastest version 1.6.5) and nfsen (version
1.3.6p1), without any trouble during the installation.
Here is some details of compilation:
$ ./configure --enable-nfprofile --with-rrdpath=/usr/bin
--prefix=/usr/local/nfsen
## --------- ##
## Platform. ##
## --------- ##
hostname = localhost.localdomain
uname -m = x86_64
uname -r = 2.6.18-274.12.1.el5
uname -s = Linux
uname -v = #1 SMP Tue Nov 29 13:37:46 EST 2011
And here is my live profile status:
[root@localhost bin]# ./nfsen -l live
name live
group (nogroup)
tcreate Tue Jan 31 15:45:00 2012
tstart Tue Jan 31 15:50:00 2012
tend Tue Jan 31 16:00:00 2012
updated Tue Jan 31 16:00:00 2012
expire 0 hours
size 17.3 MB
maxsize 0
type live
locked 0
status OK
version 130
channel peer1 sign: + colour: #0055FF order: 1 sourcelist:
peer1 Files: 3 Size: 18108416
That's look fine. Reiceving and generating graph.
I've created another one continous profile for testing, like that:
(It is a Individual Profile "WebServer" with a Channel named "Port80",
with in the filter rule below)
proto tcp and dst port 80
Here is the WebServer profile status:
[root@localhost bin]# ./nfsen -l WebServer
#
name WebServer
group (nogroup)
tcreate Tue Jan 31 16:00:04 2012
tstart Tue Jan 31 16:18:23 2012
tend Tue Jan 31 16:18:23 2012
updated Tue Jan 31 16:18:23 2012
expire 60 days 0 hours
size 0
maxsize 10.0 GB
type continuous
locked 0
status OK
version 130
channel Port80 sign: + colour: #33FF00 order: 1 sourcelist:
peer1 ERR Error reading channel stat information. Missing key
'first'
Files: 0 Size: 0
I've been always getting the "ERR Error reading channel stat
information. Missing key 'first'" message during the execution.
I tried to find out this issue on the mailing list and over the web,
but all articles suggest things that I've already done without any
success.
Here is my nfsen.conf
##############################
# NfSen master config file
##############################
$BASEDIR = "/usr/local/nfsen";
$BINDIR = "${BASEDIR}/bin";
$LIBEXECDIR = "${BASEDIR}/libexec";
$CONFDIR = "${BASEDIR}/etc";
$HTMLDIR = "/var/www/html/nfsen";
$DOCDIR = "${HTMLDIR}/doc";
$VARDIR = "/dados/nfsen";
$PIDDIR = "$VARDIR/run";
$FILTERDIR = "${VARDIR}/filters";
$FORMATDIR = "${VARDIR}/fmt";
$PROFILESTATDIR = "${BASEDIR}/profiles-stat";
$PROFILEDATADIR = "${BASEDIR}/profiles-data";
$BACKEND_PLUGINDIR = "${BASEDIR}/plugins/nfsen";
$FRONTEND_PLUGINDIR = "${HTMLDIR}/plugins";
$PREFIX = "/usr/local/nfsen/bin";
$COMMSOCKET = "$PIDDIR/nfsen.comm";
$USER = "nfsen";
$WWWUSER = "apache";
$WWWGROUP = "apache";
$BUFFLEN = 200000;
$SUBDIRLAYOUT = 1;
$ZIPcollected = 1;
$ZIPprofiles = 1;
$PROFILERS = 3;
$DISKLIMIT = 98;
%sources = (
'peer1' => { 'port' => '63636', 'col' => '#0055FF', 'type' =>
'netflow' },
);
$low_water = 90;
$syslog_facility = 'debug';
$LogSocket = 'unix';
$MAIL_FROM = '[email protected]';
$SMTP_SERVER = 'localhost';
$MAIL_BODY = q{
Alert '@alert@' triggered at timeslot @timeslot@
};
The nfsen user account was assigned in the apache group.
/etc/group:
apache:x:48:apache,nfsen
Here is the BASEDIR: directory and permission structure :
[root@localhost nfsen]# l
total 40
drwxr-xr-x 9 nfsen apache 4096 Jan 31 15:49 .
drwxr-xr-x 16 root root 4096 Jan 31 11:21 ..
drwxr-xr-x 2 nfsen apache 4096 Jan 31 15:49 bin
drwxr-xr-x 2 nfsen apache 4096 Jan 31 15:49 etc
drwxr-xr-x 2 root apache 4096 Jan 31 15:49 libexec
drwxr-xr-x 3 root apache 4096 Jan 31 15:49 plugins
drwxrwxr-x 4 nfsen apache 4096 Jan 31 16:00 profiles-data
drwxrwxr-x 4 nfsen apache 4096 Jan 31 16:00 profiles-stat
drwxr-xr-x 3 nfsen apache 4096 Jan 31 15:48 share
The data stored in profile-data directory:
[root@localhost profiles-data]# du -h
4,0K ./WebServer/Port80
8,0K ./WebServer
48M ./live/peer1/2012/01/31
48M ./live/peer1/2012/01
48M ./live/peer1/2012
49M ./live/peer1
49M ./live
49M .
Question:
I don't know why but even with "real profile" in WebServer profile
configuration any data has been stored in the profile directory. The
data is only stored in live directory.
Results:
I have graphics being generated just in live profile.
When I try to manually process some flows, (according with no data
stored in the WebServer directory), the result is:
** nfdump -M /usr/local/nfsen/profiles-data/WebServer/Port80 -T -r
2012/01/31/nfcapd.201201311630 -n 10 -s ip/flows
nfdump filter:
any
stat() error
'/usr/local/nfsen/profiles-data/WebServer/Port80/2012/01/31/nfcapd.201201311630':
File not found!
I think there is no RRD nor dependencies envolved in this issue.
I'll be very thankful with any help. Thanks in advance.
Sincerely
Tiago Flores
------------------------------------------------------------------------------
Keep Your Developer Skills Current with LearnDevNow!
The most comprehensive online learning library for Microsoft developers
is just $99.99! Visual Studio, SharePoint, SQL - plus HTML5, CSS3, MVC3,
Metro Style Apps, more. Free future releases when you subscribe now!
http://p.sf.net/sfu/learndevnow-d2d
_______________________________________________
Nfsen-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
