gmane.network.nfsen.general

Re: Crash with nfdump NSEL-1.6.10

Sebastian Hagedorn — 2013-05-24T08:27:02

Hi Peter,

thanks, all is well now, and I'm also seeing my IPv6 flows.

Cheers
Sebastian

--On 24. Mai 2013 02:26:13 +0200 Peter Haag <phaag-Rn4VEauK+AKRv+LV9MX5uipxlwaOVQ5f< at >public.gmane.org> 
wrote:

Re: nfsen (or maybe rrd) not draw diagram

Eric — 2013-05-24T03:12:46

Hi Peter,



I'm consider reinstall NFSen. Is that possible to setup nfsen & collector separately. I mean to setup nfsen on 1.1.1.1 and setup collector on 2.2.2.2, 3.3.3.3 ...and all data stored on 2.2.2.2, 3.3.3.3... I checked related manual but not found  related information.











At 2013-05-23 21:33:40,"Peter Haag" <phaag-Rn4VEauK+AKRv+LV9MX5uipxlwaOVQ5f< at >public.gmane.org> wrote:
------------------------------------------------------------------------------
Try New Relic Now & We'll Send You this Cool Shirt
New Relic is the only SaaS-based application performance monitoring service 
that delivers powerful full stack analytics. Optimize and monitor your
browser, app, & servers with just a few lines of code. Try New Relic
and get this awesome Nerd Life shirt! http://p.sf.net/sfu/newrelic_d2d_may_______________________________________________
Nfsen-discuss mailing list
Nfsen-discuss-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f< at >public.gmane.org
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss

Re: Crash with nfdump NSEL-1.6.10

Peter Haag — 2013-05-24T00:26:13

Hi Sebastian,
Sorry - I posted the mail just to nfdump-discuss. You seem to have downloaded 1.6.10 right away :)

Mail mail from Mai 18th on nfdump-dicuss:

I'm sorry for this problem! When I put 1.6.10 on sourceforge, I got the report already from another user. I immediately
withdrew the package and fixed the double free bug. Please pull a clean copy from sourceforge now. It's fixed.

Sorry for the inconvenience.

- Peter




On 5/22/13 W21 11:13, Sebastian Hagedorn wrote:

Re: nfsen (or maybe rrd) not draw diagram

Eric — 2013-05-23T14:09:20

Hi Peter,
thanks for your reply.


I've tried run command "/data/nfsen/bin/nfsen -r live", it showed "ERR Error reading channel stat information. Missing key 'first' ".


now :
1, data under profiles-data/live folder are correct, all other profiles', there are new data files for all sources every 5 mins the file size looks good.
2, data under other profile folder not correct, seems only a file would be created when service/computer restart.
3, the http://.../nfsen/nfsen.php automatically refresh every 5 mins, but the grahp no update , and the timeline stucked at last restart timeslot.


can you help? thanks








At 2013-05-23 21:33:40,"Peter Haag" <phaag-Rn4VEauK+AKRv+LV9MX5uipxlwaOVQ5f< at >public.gmane.org> wrote:
------------------------------------------------------------------------------
Try New Relic Now & We'll Send You this Cool Shirt
New Relic is the only SaaS-based application performance monitoring service 
that delivers powerful full stack analytics. Optimize and monitor your
browser, app, & serve

Re: nfsen (or maybe rrd) not draw diagram

Peter Haag — 2013-05-23T13:33:40

Hi Eric,

On 5/23/13 W21 2:36, Eric wrote:

I know, it's misleading - the rebuild process just takes a bit longer and the communication times out. This has no
impact on the rebuild process. You can check the status of the profile at any time with:

./nfsen -l live

Will be fixed in 1.3.7

- Peter

Re: nfsen (or maybe rrd) not draw diagram

Eric — 2013-05-23T00:36:14

if I try to rebuild the 'live' profile;



[root< at >nfsen1 ~]# /data/nfsen/bin/nfsen -r live

ERR Communication nfsend failed. Died at /data/nfsen/libexec/Nfcomm.pm line 1311, <$nfsen_sock> line 4.


rebuilding other profiles were all fine.









At 2013-05-22 17:14:55,Eric <eric.li-9Onoh4P/yGk< at >public.gmane.org> wrote:

Hi wim & all,
the graph still not updated although datas coming in continously.


here is what I found today, if any one can help? thanks. PS: I run the same command on all other profiles, and fine.


[root< at >nfsen1 live]# /data/nfsen/bin/nfsen -l live
name    live
group   (nogroup)
tcreate Tue Mar  5 17:00:00 2013
tstart  Tue Mar  5 17:01:37 2013
tend    Wed May 22 12:25:00 2013
updated Wed May 22 12:25:00 2013
expire  72 days 0 hours
size    0
maxsize 50.0 GB
type    live
locked  0
status  OK
version 130
channel EASTHQ  sign: + colour: #FF0000 order: 1        sourcelist: EASTHQ      ERR Error reading channel stat information. Missing key 'first'
        Files: 0        Size: 0
channel CN2BJ

Re: Huawei Netstream incompatibility with NFSEN

Francisco López — 2013-05-22T17:18:59

Hi Peter

We are in the best disposition, I mean we can send you traffic to your
Server if you prefer.

Also we can contact some one of Huawei R&D.

Please let me know.

Best regards.




On Tue, May 21, 2013 at 9:20 AM, Peter Haag <phaag-Rn4VEauK+AKRv+LV9MX5uipxlwaOVQ5f< at >public.gmane.org>wrote:

Re: nfsen (or maybe rrd) not draw diagram

Eric — 2013-05-22T09:14:55

Hi wim & all,
the graph still not updated although datas coming in continously.


here is what I found today, if any one can help? thanks. PS: I run the same command on all other profiles, and fine.


[root< at >nfsen1 live]# /data/nfsen/bin/nfsen -l live
name    live
group   (nogroup)
tcreate Tue Mar  5 17:00:00 2013
tstart  Tue Mar  5 17:01:37 2013
tend    Wed May 22 12:25:00 2013
updated Wed May 22 12:25:00 2013
expire  72 days 0 hours
size    0
maxsize 50.0 GB
type    live
locked  0
status  OK
version 130
channel EASTHQ  sign: + colour: #FF0000 order: 1        sourcelist: EASTHQ      ERR Error reading channel stat information. Missing key 'first'
        Files: 0        Size: 0
channel CN2BJ   sign: + colour: #0000ff order: 2        sourcelist: CN2BJ       ERR Error reading channel stat information. Missing key 'first'
        Files: 0        Size: 0
channel CN2CD   sign: + colour: #ff0000 order: 3        sourcelist: CN2CD       ERR Error reading channel stat information. Missing key 'first'
        Files: 0

Crash with nfdump NSEL-1.6.10

Sebastian Hagedorn — 2013-05-22T09:13:39

Hi,

we've been using nfdump/NfSen for several years, but until yesterday I 
wasn't responsible for the software itself. We had been using nfdump 1.5.4 
and all our devices were exporting netflow version 5. Because I now want to 
support IPv6 as well I upgraded to 1.6.10. I configured nfdump on a RHEL 5 
system like this:

./configure --enable-nsel --enable-compat15 --enable-nfprofile

Then I changed one of our routers to export netflow version 9 and enabled 
flows for IPv6. Now I'm getting crashes when I try to use nfdump on nfcapd 
files from that router, e.g.:

nfdump  -r /var/local/nfsen/profiles/live/bordergw/nfcapd.201305211525 -c 1 
'proto tcp'
Date first seen          Event  XEvent Proto      Src IP Addr:Port 
Dst IP Addr:Port     X-Src IP Addr:Port        X-Dst IP Addr:Port   In Byte 
Out Byte
Verify map id 0: ERROR: Expected 7 elements in map, but found 2!
2013-05-21 15:24:42.820 IGNORE  Ignore TCP       REDACTED:58335 -> 
REDACTED:445            0.0.0.0:0     ->          0.0.0.0:445         48 
0

Re: nfsen graphs, choppy looking

Peter Haag — 2013-05-21T15:25:09

Hi Aki,
Make sure your expire timeout settings on the router are set to fit with NfSen 5min intervals. Anything which properly
divides in the interval can be taken: 300/x = number.

Regards

- Peter

On 5/21/13 W21 10:22, Áki . wrote:

------------------------------------------------------------------------------
Try New Relic Now & We'll Send You this Cool Shirt
New Relic is the only SaaS-based application performance monitoring service 
that delivers powerful full stack analytics. Optimize and monitor your
browser, app, & servers with just a few lines of code. Try New Relic
and get this awesome Nerd Life shirt! http://p.sf.net/sfu/newrelic_d2d_may

Re: Last three hours graphs, but no statistics or data

Peter Haag — 2013-05-21T15:30:38

Ohh - overlooked this answer! Sorry for the Spam.

- Peter

On 5/21/13 W21 16:53, James Wright wrote:

Re: Last three hours graphs, but no statistics or data

Peter Haag — 2013-05-21T15:29:15

Hmm .. rater strange ... Any timezone issues? East/West coast? 3 hours ?

- Peter

On 5/21/13 W21 14:29, James Wright wrote:

Re: Huawei Netstream incompatibility with NFSEN

Peter Haag — 2013-05-21T15:20:03

I never worked with Huawei. I need to check that.

Regards

- Peter

On 5/21/13 W21 3:48, Francisco López wrote:

Re: Nfsen scalability and data aggregation on graphs

Peter Haag — 2013-05-21T15:16:56

Hi Adrian,
On 5/20/13 W21 7:43, Adrian Popa wrote:

True - at the moment, there is no distributed architecture. I know, it's an issue and it's on the todo list.
Meamwhile, yes - you can distribute collectors connecting over NFS, however, I don't know if this scales. How important
is this for you and for others?


True - how would you like to aggregate flow data? What makes sense in your view?

- Peter

Re: Last three hours graphs,but no statistics or data

James Wright — 2013-05-21T14:53:38

Hi Adrian,

You are brilliant, thank you!  That is exactly what I was missing.
The php.ini still specified UTC.  I made the change, restarted
services, and now everything looks great.


Thanks,
James


On Tue, May 21, 2013 at 8:51 AM, Adrian Popa <adrian.popa.gh-Re5JQEeQqe8AvxtiuMwx3w< at >public.gmane.org> wrote:

------------------------------------------------------------------------------
Try New Relic Now & We'll Send You this Cool Shirt
New Relic is the only SaaS-based application performance monitoring service 
that delivers powerful full stack analytics. Optimize and monitor your
browser, app, & servers with just a few lines of code. Try New Relic
and get this awesome Nerd Life shirt! http://p.sf.net/sfu/newrelic_d2d_may

Re: Last three hours graphs,but no statistics or data

Adrian Popa — 2013-05-21T12:51:40

What about timezone? The nfcapd process may be using GMT time while your
PHP installation has a different timezone set (or viceversa). You should
find relevant information in /etc/timezone and /etc/php5/apache2/php.ini
(or whatever it's called in your distribution). The timezones should be the
same.


On Tue, May 21, 2013 at 3:29 PM, James Wright <jamfwright-Re5JQEeQqe8AvxtiuMwx3w< at >public.gmane.org> wrote:

------------------------------------------------------------------------------
Try New Relic Now & We'll Send You this Cool Shirt
New Relic is the only SaaS-based application performance monitoring service 
that delivers powerful full stack analytics. Optimize and monitor your
browser, app, & servers with just a few lines of code. Try New Relic
and get this awesome Nerd Life shirt! http://p.sf.net/sfu/newrelic_d2d_may_______________________________________________
Nfsen-discuss mailing list
Nfsen-discuss-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f< at >public.gmane.org
https://lists.sourceforge.net/lists/listinfo/nfsen-di

Last three hours graphs, but no statistics or data

James Wright — 2013-05-21T12:29:57

Hello List,

Apologies if this was previously asked or addressed, if it was I missed it.

Currently installed:

OS:  openSUSE 12.2 x64
Kernel:  3.4.6-2.10-desktop
NFDump:  1.6.9
NFSen:  1.3.6
RRD Tool:  1.4.7-4.1.2
Apache:  2.2.22-4.14.1
PHP5:  5.3.15-1.12.1

My recent install of nfdump/nfsen looks great and works well with one
exception.  I never have statistics or data for the last three hours,
though the graph seems to be correctly reflecting that same time
frame.

In the statistics area of the page I just get X's where numbers
usually appear, unless I move the timeslot back at least three hours.

Similarly, if I try to draw up any information in the Netflow
Processing area, I get errors like this:


** nfdump -M /data/nfsen/profiles-data/live/le-gw-1:le-gw:le-gw-2  -T
-r 2013/05/20/nfcapd.201305201915 -n 10 -s ip/flows
nfdump filter:
any
stat() error '/data/nfsen/profiles-data/live/le-gw-1/2013/05/20/nfcapd.201305201915':
File not found!
stat() error '/data/nfsen/profiles-data/live/le-gw/2013/05/20/nfcap

nfsen graphs, choppy looking

Áki . — 2013-05-21T08:22:56

Hi guys,
I have been using nfsen for a while now and I always have very choppy graphs like this: http://i.imgur.com/SCNNwKC.png
This is the packets view, flows and bytes views look the exact same way. I have collected via Cisco 7600's, 2900 and various other routers. Even sniff to flow conversion.. it always ends up the same way. Is there any way to make these graphs smooth to reflect the actual traffic ?
Some configuration I'm missing?
-Aki       ------------------------------------------------------------------------------
Try New Relic Now & We'll Send You this Cool Shirt
New Relic is the only SaaS-based application performance monitoring service 
that delivers powerful full stack analytics. Optimize and monitor your
browser, app, & servers with just a few lines of code. Try New Relic
and get this awesome Nerd Life shirt! http://p.sf.net/sfu/newrelic_d2d_may_______________________________________________
Nfsen-discuss mailing list
Nfsen-discuss-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f< at >public.gmane.org
https:

Huawei Netstream incompatibility with NFSEN

Francisco López — 2013-05-21T01:48:53

Hi NFSEN community

Does any one knows if NFSEN have incompatibility's with Netstream flow from
Huawei Routers?

Does ay one Knows if we need to change some config at the NFSEN Server?

We have been test it, with Many MTU size at the server, and the Netstream
flow report just 7 Mbps.

I'm attaching two pcap files in order to idetify the problem issue between
Flow Cisco and Netstream, also the config at the Router Huawei.

If some one knows how to work, please let me know.

Thanks community


system
 ip netstream export version 5 origin-as
 ip netstream sampler fix-packets 1000 inbound
 ip netstream sampler fix-packets 1000 outbound
 ip netstream export source 172.16.10.13
 ip netstream export host 10.13.1.46 9983
 ip netstream timeout active 60
ip netstream aggregation as
 ip netstream export source 172.16.10.13
 ip netstream export host 10.60.35.61 9993
 enable

slot 1
GigabitEthernet1/1/0
 ip netstream inbound

slot 3
GigabitEthernet3/0/0
 ip netstream inbound
 ip netstream outbound

slot 6
GigabitEthernet

Re: nfsen (or maybe rrd) not draw diagram

Wim Biemolt — 2013-05-20T14:44:46


I'm afraid I can't really help. But since you mentioned rrd in the
subject. I performed some upgrades myself yesterday, nfdump from
1.6.9 to 1.6.10 but also from 'rrdtool-1.4.5' to 'rrdtool-1.4.7_2'.
After the upgrade all pictures have become "empty" (zero in size).
Everything else seems to work fine. But no pictures anymore :-(

Cheers,

-Wim

------------------------------------------------------------------------------
AlienVault Unified Security Management (USM) platform delivers complete
security visibility with the essential security capabilities. Easily and
efficiently configure, manage, and operate all of your security controls
from a single console and one unified framework. Download a free trial.
http://p.sf.net/sfu/alienvault_d2d

Re: Nfsen scalability and data aggregation on graphs

Adrian Popa — 2013-05-20T05:43:28

1. As far as I know there is no distributed nfsen architecture with a
centralized webend. It could probably be hacked on with running nfdump on
various hosts and exporting the folders read-only over NFS + a centralized
nfsen that would do only the displaying, but it would be a hack at this
point (IMHO)
2. Raw data is never aggregated. It is just expired automatically after a
set period of time/disk space. Even if you expire the data you will still
have graphs for up to one year (that's how the RRD is set up). The graphs
themselves do data aggregation (averaging), but this is a function of
rrdgraph.

Hope it helps,
Adrian


On Sat, May 18, 2013 at 3:24 AM, Allen Chan <Allen.Chan-74cPPAvpV1gAvxtiuMwx3w< at >public.gmane.org> wrote:

------------------------------------------------------------------------------
AlienVault Unified Security Management (USM) platform delivers complete
security visibility with the essential security capabilities. Easily and
efficiently configure, manage, and operate all of your security