I have a linux system running ntopng 1.1_6932 and a Win32 system running nprobe 6.15.131114. The probe sends zmq flows to the Linux ntopng device.
- The ntopng system has been up for 5:17:49 - The probe was started first by about ten seconds - I have ~1375 remote hosts that check in with the server where nProbe is running, every five minutes I would expect that the 'First seen' for all those hosts would be something like 5:18:00 to 5:23:00 since the start of the system but they vary from 2-3 minutes ago to 20-30 minutes ago though a few are several hours old. When I search the hosts for a system I know has checked in I see " Perhaps this host has been previously purged from memory or it has never been observed by this ntopng instance". Is there a way to NOT purge hosts? I focused on one host in particular and it showed up in the ntopng hosts right after I saw it on the server via windump but was purged out of ntopng stats before its next 5 minute check in. I would like to have persistent data about all hosts over time, hopefully this is possible? Thanks! Phil Example: IP Address 10.25.86.167 Name 10.25.86.167 Remote Private IP First Seen 15/11/2013 15:35:17 [23 min, 29 sec ago] Last Seen 15/11/2013 15:58:14 [32 sec ago] (c) 1998-2013 - ntop.org Generated by ntopng v.1.1 (r) for user admin and interface [email protected]:5556 222.63 Kbps [82 pps] Uptime: 5 h, 17 min, 49 sec Notice: This e-mail message and its attachments are the property of The Wendy's Company or one of its subsidiaries and may contain confidential or legally privileged information intended solely for the use of the addressee(s). If you are not an intended recipient, then any use, copying or distribution of this message or its attachments is strictly prohibited. If you received this message in error, please notify the sender and delete this message entirely from your system. _______________________________________________ Ntop-misc mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-misc
