Adrian is right: there is no problem with configuration itself, I didn’t realized that something changed during copy/paste
When you say check the permissions on nfcapd directory and files, do you mean the directory that contains all the files collected by nfcap in live directory? If that is the case, then the answer is: when I copied the collected files from the first PC into the second server, I’ve made sure to set all permissions identical. But I don’t think that’s the problem: the data from PC1 is recovered and displayed correctly in nfsen, which would prove that things went correctly. The problem is after that step, once I’ve put the old data into my new server, and rebuilt the live profile to include this data, well nfsen stops collecting anything… I believe the problem has something to do with the fact that the data I’m trying to feed into the new system is older than the time when I created nfsen on the new server… it may cause confusion somewhere De : Adrian Popa [mailto:[email protected]] Envoyé : vendredi 16 octobre 2015 10:50 Cc : NFSen-Discuss Objet : Re: [Nfsen-discuss] Copy collected data from PC to server I don't think there's a problem with the configuration. Most likely the $ signs indicate truncated output from an editor. Can you also check the permissions on your nfcapd directory and files? Maybe the nfcapd process (which runs as netflow user) doesn't have write access to the folder. Also, do you have Selinux enabled? On Thu, Oct 15, 2015 at 4:23 PM, Alexandro Marcelo Zacaron <[email protected]<mailto:[email protected]>> wrote: Hi Elouan, In your config file, is there sintaxe error in line Cisco2. It ended with the line "$" end should it's " 'IP' = => 'u.v.w.x'}, " %sources = ( # 'upstream1' => { 'port' => '9995', 'col' => '#0000ff', 'type' => 'netfl$ # 'peer1' => { 'port' => '9996', 'IP' => '172.16.17.18' }, # 'peer2' => { 'port' => '9996', 'IP' => '172.16.17.19' }, 'Cisco2' => { 'port' => '2055' , 'col' => '#0000FF' , 'IP' => 'u.v.w.x$ 'STSD' => { 'port' => '2055' , 'col' => '#CC00CC' , 'IP' => a.b.c.d' }, ); I hope this helps Best Regards, Zacaron 2015-10-15 4:58 GMT-03:00 <[email protected]<mailto:[email protected]>>: Send Nfsen-discuss mailing list submissions to [email protected]<mailto:[email protected]> To subscribe or unsubscribe via the World Wide Web, visit https://lists.sourceforge.net/lists/listinfo/nfsen-discuss or, via email, send a message with subject or body 'help' to [email protected]<mailto:[email protected]> You can reach the person managing the list at [email protected]<mailto:[email protected]> When replying, please edit your Subject line so it is more specific than "Re: Contents of Nfsen-discuss digest..." Today's Topics: 1. Re: Copy collected data from PC to server (Adrian Popa) 2. Re: Copy collected data from PC to server (LE-BRETTON, ELOUAN (ELOUAN)) ---------------------------------------------------------------------- Message: 1 Date: Thu, 15 Oct 2015 10:51:54 +0300 From: Adrian Popa <[email protected]<mailto:[email protected]>> Subject: Re: [Nfsen-discuss] Copy collected data from PC to server To: "LE-BRETTON, ELOUAN (ELOUAN)" <[email protected]<mailto:[email protected]>> Cc: "[email protected]<mailto:[email protected]>" <[email protected]<mailto:[email protected]>> Message-ID: <caokso161b2+cqd-stb70dzufbsa9z62bcspqwg3ydwrmhxl...@mail.gmail.com<mailto:caokso161b2%[email protected]>> Content-Type: text/plain; charset="utf-8" I'm not sure if the port isn't the issue. Can you try a different port for the Cisco2 device? A different port means a different collector process as well. On Thu, Oct 15, 2015 at 10:46 AM, LE-BRETTON, ELOUAN (ELOUAN) < [email protected]<mailto:[email protected]>> wrote: > Here it is. > > > > %sources = ( > > # 'upstream1' => { 'port' => '9995', 'col' => '#0000ff', 'type' => > 'netfl$ > > # 'peer1' => { 'port' => '9996', 'IP' => '172.16.17.18' }, > > # 'peer2' => { 'port' => '9996', 'IP' => '172.16.17.19' }, > > 'Cisco2' => { 'port' => '2055' , 'col' => '#0000FF' , 'IP' => 'u.v.w.x$ > > 'STSD' => { 'port' => '2055' , 'col' => '#CC00CC' , 'IP' => a.b.c.d' }, > > ); > > > > STSD is the router I was collecting on the PC and whose data I transferred > to the server > > Cisco2 is the routeur I?m collecting on my serveur. > > > > At the moment I?ve come up with two possible explanations, I?ve hadn?t > found the time to test if one is the correct one: > > 1. The time when the collection on STSD is before nfsen was > installed: maybe this creates a problem because I?m trying to add data in > ?live? profile before it was created ? > > 2. I?ve used this command: Launch command : nfsen ?r live > all. Maybe I should create another profile, a history profile, to avoid > conflict between the live profile and the data?? > > > > *De :* Adrian Popa > [mailto:[email protected]<mailto:[email protected]>] > *Envoy? :* jeudi 15 octobre 2015 08:09 > *? :* LE-BRETTON, ELOUAN (ELOUAN) > *Cc :* > [email protected]<mailto:[email protected]> > *Objet :* Re: [Nfsen-discuss] Copy collected data from PC to server > > > > Can you show us your %sources config? > > > > On Wed, Oct 14, 2015 at 5:00 PM, LE-BRETTON, ELOUAN (ELOUAN) < > [email protected]<mailto:[email protected]>> > wrote: > > Hi, > > > > Here is my situation : a few weeks ago, I?ve installed nfsen on a PC and > used it to collect data from a source. Let?s call Let?s call that source > sourcePC. Now I?ve installed nfsen on a server, and I use it to collect > data from another router, let?s call that source SourceServer. It all works > fine. > > Now I want to import the data collected on the PC into the server. > > I?ve tried the following steps: > > - On the server, added sourcePC (using the same settings that I > used on the PC). > > - On the server, copy the data coming from the PC > > - Launch command : nfsen ?r live all > > > > At first it seemed to work: I could see the data coming from sourcePC, see > the graph, launch some filters and stuff > > > > But then, I realized that the sourceServer didn?t work properly anymore: > no new data was available from sourceServer. I?ve checked that the server > was receiving netflow parquets from sourceServer (using Wireshark). If I > remove sourcePC from the nfsen config file on the server, then it?s working > properly? > > > > I don?t know what I should do now: how can I import the data that I > collected on my PC into the server ? > > > > Regards, > > Elouan > > > > ------------------------------------------------------------------------------ > > _______________________________________________ > Nfsen-discuss mailing list > [email protected]<mailto:[email protected]> > https://lists.sourceforge.net/lists/listinfo/nfsen-discuss > > > -------------- next part -------------- An HTML attachment was scrubbed... ------------------------------ Message: 2 Date: Thu, 15 Oct 2015 07:58:24 +0000 From: "LE-BRETTON, ELOUAN (ELOUAN)" <[email protected]<mailto:[email protected]>> Subject: Re: [Nfsen-discuss] Copy collected data from PC to server To: Adrian Popa <[email protected]<mailto:[email protected]>> Cc: "[email protected]<mailto:[email protected]>" <[email protected]<mailto:[email protected]>> Message-ID: <48cc295db612d744ad3555c102ca43b9013d1ec...@fr711wxchmba01.zeu.alcatel-lucent.com<mailto:48cc295db612d744ad3555c102ca43b9013d1ec...@fr711wxchmba01.zeu.alcatel-lucent.com>> Content-Type: text/plain; charset="utf-8" I don?t really like the idea of changing the port. First, I?ve worked before on a test lab a configuration with 3 different routers, each one configured to send data on port 2055. [To configure several sources on nfsen, I simply give the source IP address, as you see below. nfsen seems to distinguish them without problem]. Second, port 2055 is an industry standard for netflow, I?m not really keen at the idea of changing that, it has many ripple effects (I have to reconfigure the router, wireshark needs to be told that 2055 is not cflow anymore, I have a firewall configured that I need to change?. ) De : Adrian Popa [mailto:[email protected]<mailto:[email protected]>] Envoy? : jeudi 15 octobre 2015 09:52 ? : LE-BRETTON, ELOUAN (ELOUAN) Cc : [email protected]<mailto:[email protected]> Objet : Re: [Nfsen-discuss] Copy collected data from PC to server I'm not sure if the port isn't the issue. Can you try a different port for the Cisco2 device? A different port means a different collector process as well. On Thu, Oct 15, 2015 at 10:46 AM, LE-BRETTON, ELOUAN (ELOUAN) <[email protected]<mailto:[email protected]><mailto:[email protected]<mailto:[email protected]>>> wrote: Here it is. %sources = ( # 'upstream1' => { 'port' => '9995', 'col' => '#0000ff', 'type' => 'netfl$ # 'peer1' => { 'port' => '9996', 'IP' => '172.16.17.18' }, # 'peer2' => { 'port' => '9996', 'IP' => '172.16.17.19' }, 'Cisco2' => { 'port' => '2055' , 'col' => '#0000FF' , 'IP' => 'u.v.w.x$ 'STSD' => { 'port' => '2055' , 'col' => '#CC00CC' , 'IP' => a.b.c.d' }, ); STSD is the router I was collecting on the PC and whose data I transferred to the server Cisco2 is the routeur I?m collecting on my serveur. At the moment I?ve come up with two possible explanations, I?ve hadn?t found the time to test if one is the correct one: 1. The time when the collection on STSD is before nfsen was installed: maybe this creates a problem because I?m trying to add data in ?live? profile before it was created ? 2. I?ve used this command: Launch command : nfsen ?r live all. Maybe I should create another profile, a history profile, to avoid conflict between the live profile and the data?? De : Adrian Popa [mailto:[email protected]<mailto:[email protected]><mailto:[email protected]<mailto:[email protected]>>] Envoy? : jeudi 15 octobre 2015 08:09 ? : LE-BRETTON, ELOUAN (ELOUAN) Cc : [email protected]<mailto:[email protected]><mailto:[email protected]<mailto:[email protected]>> Objet : Re: [Nfsen-discuss] Copy collected data from PC to server Can you show us your %sources config? On Wed, Oct 14, 2015 at 5:00 PM, LE-BRETTON, ELOUAN (ELOUAN) <[email protected]<mailto:[email protected]><mailto:[email protected]<mailto:[email protected]>>> wrote: Hi, Here is my situation : a few weeks ago, I?ve installed nfsen on a PC and used it to collect data from a source. Let?s call Let?s call that source sourcePC. Now I?ve installed nfsen on a server, and I use it to collect data from another router, let?s call that source SourceServer. It all works fine. Now I want to import the data collected on the PC into the server. I?ve tried the following steps: - On the server, added sourcePC (using the same settings that I used on the PC). - On the server, copy the data coming from the PC - Launch command : nfsen ?r live all At first it seemed to work: I could see the data coming from sourcePC, see the graph, launch some filters and stuff But then, I realized that the sourceServer didn?t work properly anymore: no new data was available from sourceServer. I?ve checked that the server was receiving netflow parquets from sourceServer (using Wireshark). If I remove sourcePC from the nfsen config file on the server, then it?s working properly? I don?t know what I should do now: how can I import the data that I collected on my PC into the server ? Regards, Elouan ------------------------------------------------------------------------------ _______________________________________________ Nfsen-discuss mailing list [email protected]<mailto:[email protected]><mailto:[email protected]<mailto:[email protected]>> https://lists.sourceforge.net/lists/listinfo/nfsen-discuss -------------- next part -------------- An HTML attachment was scrubbed... ------------------------------ ------------------------------------------------------------------------------ ------------------------------ _______________________________________________ Nfsen-discuss mailing list [email protected]<mailto:[email protected]> https://lists.sourceforge.net/lists/listinfo/nfsen-discuss End of Nfsen-discuss Digest, Vol 111, Issue 4 ********************************************* -- Alexandro Marcelo Zacaron +55 45 9942 8561<tel:%2B55%2045%209942%208561> ------------------------------------------------------------------------------ _______________________________________________ Nfsen-discuss mailing list [email protected]<mailto:[email protected]> https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
------------------------------------------------------------------------------
_______________________________________________ Nfsen-discuss mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
