Hi Joel, Disabling checks is harmless, apart from having the benefit of removing you the annoying part of those warning messages. But one more question: you say sending two streams but i see only a single exporter, 'agent=X:0'. Is it X reallt corresponding to a single IP address (which would justify the warnings) or not? If yes, would it be possible for you to send me privately a brief trace of the export packets from that agent?
Cheers, Paolo On Wed, Dec 04, 2013 at 03:53:04PM -0800, Joel Krauska wrote: > Paolo, > > Sorry I missed that you had replied. > > Yes, these happen all the time. > > There's a big burst on startup and then a pretty steady one afterwards. > > It looks like the later burst might be due to sending two streams? > > > INFO ( testing/print ): *** Purging cache - START *** > INFO ( testing/print ): *** Purging cache - END (QN: 6, ET: 0) *** > WARN: expecting flow '25593234' but received '234608' > collector=0.0.0.0:6001agent=X:0 > WARN: expecting flow '234609' but received '25593234' > collector=0.0.0.0:6001agent=X:0 > WARN: expecting flow '25593299' but received '234609' > collector=0.0.0.0:6001agent=X:0 > WARN: expecting flow '234610' but received '25593299' > collector=0.0.0.0:6001agent=X:0 > WARN: expecting flow '25593367' but received '234610' > collector=0.0.0.0:6001agent=X:0 > WARN: expecting flow '234611' but received '25593367' > collector=0.0.0.0:6001agent=X:0 > INFO ( testing/print ): *** Purging cache - START *** > INFO ( testing/print ): *** Purging cache - END (QN: 7, ET: 0) *** > WARN: expecting flow '25593429' but received '234611' > collector=0.0.0.0:6001agent=X:0 > WARN: expecting flow '234612' but received '25593429' > collector=0.0.0.0:6001agent=X:0 > WARN: expecting flow '25593510' but received '234612' > collector=0.0.0.0:6001agent=X:0 > WARN: expecting flow '234613' but received '25593510' > collector=0.0.0.0:6001agent=X:0 > WARN: expecting flow '25593572' but received '234613' > collector=0.0.0.0:6001agent=X:0 > WARN: expecting flow '234614' but received '25593572' > collector=0.0.0.0:6001agent=X:0 > > See how the flow numbers flip back and forth between 234k and 25M? > > I'm willing to disable checks, but I wouldn't want to miss other debug > information in my testing. > > Cheers, > > Joel > > > On Mon, Nov 11, 2013 at 3:16 PM, Paolo Lucente <pa...@pmacct.net> wrote: > > > Hi Joel, > > > > Could also be packets are received out of order, which can be > > harmless depending on the use-cases. Anyway if annoying these > > messages can be disabled by setting nfacctd_disable_checks to > > true. I propose this idea because i don't seem to have seen > > such warnings on a regular basis on other IPFIX exports. Maybe > > would help if you can define better "frequently". Is that like > > in always, at times, in specific times of the day, or ..? > > > > Cheers, > > Paolo > > > > On Sun, Nov 10, 2013 at 06:26:22PM -0800, Joel Krauska wrote: > > > (I should have mentioned I'm testing rc1 > > > NetFlow Accounting Daemon, nfacctd 1.5.0rc1 (20130829-00) > > > --enable-mysql --enable-64bit --enable-threads --enable-geoip > > > > > > I frequently get these Warnings. > > > > > > WARN: expecting flow '4423369' but received '4423371' > > > collector=0.0.0.0:6001agent=BLAH:0 > > > WARN: expecting flow '4423371' but received '4423372' > > > collector=0.0.0.0:6001agent=BLAH:0 > > > WARN: expecting flow '4423372' but received '4423374' > > > collector=0.0.0.0:6001agent=BLAH:0 > > > WARN: expecting flow '4423374' but received '4423375' > > > collector=0.0.0.0:6001agent=BLAH:0 > > > WARN: expecting flow '4423375' but received '4423376' > > > collector=0.0.0.0:6001agent=BLAH:0 > > > > > > It seems odd to see them in series like this, since the 'expected' > > usually > > > is the one it just received just before... > > > > > > Looks like possibly an off by 1 error? > > > > > > Cheers, > > > > > > Joel > > > > > _______________________________________________ > > > pmacct-discussion mailing list > > > http://www.pmacct.net/#mailinglists > > > > > > _______________________________________________ > > pmacct-discussion mailing list > > http://www.pmacct.net/#mailinglists > > _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
