On 1/31/12 19:45, Tiago Flôres wrote:
> Hello guys,
>
> I've installed nfdump (lastest version 1.6.5) and nfsen (version
> 1.3.6p1), without any trouble during the installation.
>
> Here is some details of compilation:
>
> $ ./configure --enable-nfprofile --with-rrdpath=/usr/bin
> --prefix=/usr/local/nfsen
>
> ## --------- ##
> ## Platform. ##
> ## --------- ##
>
> hostname = localhost.localdomain
> uname -m = x86_64
> uname -r = 2.6.18-274.12.1.el5
> uname -s = Linux
> uname -v = #1 SMP Tue Nov 29 13:37:46 EST 2011
>
> And here is my live profile status:
>
> [root@localhost bin]# ./nfsen -l live
> name live
> group (nogroup)
> tcreate Tue Jan 31 15:45:00 2012
> tstart Tue Jan 31 15:50:00 2012
> tend Tue Jan 31 16:00:00 2012
> updated Tue Jan 31 16:00:00 2012
> expire 0 hours
> size 17.3 MB
> maxsize 0
> type live
> locked 0
> status OK
> version 130
> channel peer1 sign: + colour: #0055FF order: 1 sourcelist:
> peer1 Files: 3 Size: 18108416
>
> That's look fine. Reiceving and generating graph.
>
> I've created another one continous profile for testing, like that:
>
> (It is a Individual Profile "WebServer" with a Channel named "Port80",
> with in the filter rule below)
>
> proto tcp and dst port 80
>
> Here is the WebServer profile status:
>
> [root@localhost bin]# ./nfsen -l WebServer
> #
> name WebServer
> group (nogroup)
> tcreate Tue Jan 31 16:00:04 2012
> tstart Tue Jan 31 16:18:23 2012
> tend Tue Jan 31 16:18:23 2012
> updated Tue Jan 31 16:18:23 2012
> expire 60 days 0 hours
> size 0
> maxsize 10.0 GB
> type continuous
> locked 0
> status OK
> version 130
> channel Port80 sign: + colour: #33FF00 order: 1 sourcelist:
> peer1 ERR Error reading channel stat information. Missing key
> 'first'
This message goes away as soon as you have any files in your directory.
For some reason the profiling does not produce any output file. Check your
syslog file. I'm pretty sure your nfprofile has an RRD binding issue, or
it does not file the library while binding or needs some other libraries
to resolve.
Regards
- Peter
> Files: 0 Size: 0
>
>
> I've been always getting the "ERR Error reading channel stat
> information. Missing key 'first'" message during the execution.
>
> I tried to find out this issue on the mailing list and over the web,
> but all articles suggest things that I've already done without any
> success.
>
> Here is my nfsen.conf
>
> ##############################
> # NfSen master config file
> ##############################
>
> $BASEDIR = "/usr/local/nfsen";
> $BINDIR = "${BASEDIR}/bin";
> $LIBEXECDIR = "${BASEDIR}/libexec";
> $CONFDIR = "${BASEDIR}/etc";
> $HTMLDIR = "/var/www/html/nfsen";
> $DOCDIR = "${HTMLDIR}/doc";
> $VARDIR = "/dados/nfsen";
> $PIDDIR = "$VARDIR/run";
> $FILTERDIR = "${VARDIR}/filters";
> $FORMATDIR = "${VARDIR}/fmt";
> $PROFILESTATDIR = "${BASEDIR}/profiles-stat";
> $PROFILEDATADIR = "${BASEDIR}/profiles-data";
> $BACKEND_PLUGINDIR = "${BASEDIR}/plugins/nfsen";
> $FRONTEND_PLUGINDIR = "${HTMLDIR}/plugins";
> $PREFIX = "/usr/local/nfsen/bin";
> $COMMSOCKET = "$PIDDIR/nfsen.comm";
> $USER = "nfsen";
> $WWWUSER = "apache";
> $WWWGROUP = "apache";
> $BUFFLEN = 200000;
> $SUBDIRLAYOUT = 1;
> $ZIPcollected = 1;
> $ZIPprofiles = 1;
> $PROFILERS = 3;
> $DISKLIMIT = 98;
>
> %sources = (
> 'peer1' => { 'port' => '63636', 'col' => '#0055FF', 'type' =>
> 'netflow' },
> );
>
> $low_water = 90;
> $syslog_facility = 'debug';
> $LogSocket = 'unix';
>
> $MAIL_FROM = '[email protected]';
> $SMTP_SERVER = 'localhost';
> $MAIL_BODY = q{
> Alert '@alert@' triggered at timeslot @timeslot@
> };
>
>
> The nfsen user account was assigned in the apache group.
>
> /etc/group:
>
> apache:x:48:apache,nfsen
>
>
>
> Here is the BASEDIR: directory and permission structure :
>
> [root@localhost nfsen]# l
> total 40
> drwxr-xr-x 9 nfsen apache 4096 Jan 31 15:49 .
> drwxr-xr-x 16 root root 4096 Jan 31 11:21 ..
> drwxr-xr-x 2 nfsen apache 4096 Jan 31 15:49 bin
> drwxr-xr-x 2 nfsen apache 4096 Jan 31 15:49 etc
> drwxr-xr-x 2 root apache 4096 Jan 31 15:49 libexec
> drwxr-xr-x 3 root apache 4096 Jan 31 15:49 plugins
> drwxrwxr-x 4 nfsen apache 4096 Jan 31 16:00 profiles-data
> drwxrwxr-x 4 nfsen apache 4096 Jan 31 16:00 profiles-stat
> drwxr-xr-x 3 nfsen apache 4096 Jan 31 15:48 share
>
>
> The data stored in profile-data directory:
>
> [root@localhost profiles-data]# du -h
> 4,0K ./WebServer/Port80
> 8,0K ./WebServer
> 48M ./live/peer1/2012/01/31
> 48M ./live/peer1/2012/01
> 48M ./live/peer1/2012
> 49M ./live/peer1
> 49M ./live
> 49M .
>
> Question:
> I don't know why but even with "real profile" in WebServer profile
> configuration any data has been stored in the profile directory. The
> data is only stored in live directory.
>
>
> Results:
>
> I have graphics being generated just in live profile.
>
> When I try to manually process some flows, (according with no data
> stored in the WebServer directory), the result is:
>
> ** nfdump -M /usr/local/nfsen/profiles-data/WebServer/Port80 -T -r
> 2012/01/31/nfcapd.201201311630 -n 10 -s ip/flows
> nfdump filter:
> any
> stat() error
> '/usr/local/nfsen/profiles-data/WebServer/Port80/2012/01/31/nfcapd.201201311630':
> File not found!
>
>
> I think there is no RRD nor dependencies envolved in this issue.
>
> I'll be very thankful with any help. Thanks in advance.
>
> Sincerely
>
> Tiago Flores
>
> ------------------------------------------------------------------------------
> Keep Your Developer Skills Current with LearnDevNow!
> The most comprehensive online learning library for Microsoft developers
> is just $99.99! Visual Studio, SharePoint, SQL - plus HTML5, CSS3, MVC3,
> Metro Style Apps, more. Free future releases when you subscribe now!
> http://p.sf.net/sfu/learndevnow-d2d
> _______________________________________________
> Nfsen-discuss mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
--
--
Be nice to your netflow data
------------------------------------------------------------------------------
Keep Your Developer Skills Current with LearnDevNow!
The most comprehensive online learning library for Microsoft developers
is just $99.99! Visual Studio, SharePoint, SQL - plus HTML5, CSS3, MVC3,
Metro Style Apps, more. Free future releases when you subscribe now!
http://p.sf.net/sfu/learndevnow-d2d
_______________________________________________
Nfsen-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
