Hello,
Seems that Nfdump for a given interval includes flows that have started
before the interval, so statistics get exaggerated. Any hint?
Details are given below.
Many thanks in advance,
Bruno.
----
I use nfdump with two time intervals, with a filter for selecting IP
sources that write to a recipient: daily (00:00-23:59) for a cumulative
sum of all writes, and every 5 minutes for the top 20 writers. See below
for the nfdump options.
At the end of the day, nfdump says 56TB have been written, while if I
sum up all 5-minute results I get 99TB (while it should be below 56TB!).
By the way, the 56TB already seem to be the result of flows that began
several days ago - because the same day only 8TB have been seen written
using a different tool.
Looks like a flow that began before is counted several times, is it
possible to count only what has been exchanged during the time interval?
1) Daily:
nfdump -M /opt/nfsen/profiles-data/live/$AGGR_SWITCHES \
-R $startfile:$endfile \
-T \
-f $HOMEDIR/gz196.nfsen_filter | grep "total bytes:" | awk '{
nb=$7;
if ((nb!=0) && (nb!="0,")) {
subnb=substr(nb,1,length(nb)-1); # remove the trailing comma
if(substr(nb,length(nb),1)==",")
nb=subnb/1000000000; # expressed in bytes => divide by 10^9
else {
unit=substr($8,1,1); # remove the comma from the unit
if (unit=="M") nb=nb/1024;
if (unit=="T") nb=nb*1024;
# no change if G
}
}
else nb=0;
printf("%s\n",nb);
}'
2) Every 5 minutes:
nfdump -M /opt/nfsen/profiles-data/live/$AGGR_SWITCHES \
-R $startfile:$endfile \
-T \
-n 20 \
-s record/bytes \
-o extended \
-f $HOMEDIR/gz196.nfsen_filter | perl -i -p -e 'use Socket;
s#(\d{1,3}(\.\d{1,3}){3})\b#gethostbyaddr(inet_aton($1), AF_INET) or
sprintf($1)#egi'
Many thanks in advance,
Bruno.
_____________________________________________________________________
o
o o o Bruno LEBAYLE - Systems and Communications group
o o o o o E.S.R.F (European Synchrotron Radiation Facility)
o ooo o 71, avenue des Martyrs CS40220
o o o ooooo o o o 38043 GRENOBLE CEDEX 9
o ooo o phone (33)4-7688-2258
o o o o o fax (33)4-7688-2020
o o o email [email protected]
o http://www.esrf.fr
_____________________________________________________________________
------------------------------------------------------------------------------
_______________________________________________
Nfsen-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
