On Mon, Nov 29, 2004 at 01:39:11PM -0500, [EMAIL PROTECTED] wrote:
> >I don't think it can do that. The best thing to do is write a script that
> >flow-cat's the 3 files into one and put that script into cron to have it
> >done every 15 minutes.
>
> >Mike
>
>
> Mike, I switched from cflowd to flow-tools... I had this configuration in my
> cflowd.conf: [TWO EXPORTERS]
>
> CISCOEXPORTER {
> HOST: 172.26.1.100 # IP address of Cisco sending data.
> ADDRESSES: {172.26.1.100}
> CFDATAPORT: 9999 # Port on which to listen for data.
> SNMPCOMM: 'ketshup' # SNMP community name.
> LOCALAS: 9100 # Local AS of Cisco sending data.
> COLLECT: { protocol, portmatrix, ifmatrix, nexthop, netmatrix,
> asmatrix,
> tos, flows }
> }
>
> CISCOEXPORTER {
> HOST: 172.16.203.1 # IP address of Cisco sending data.
> ADDRESSES: {172.16.203.1}
> CFDATAPORT: 9998 # Port on which to listen for data.
> SNMPCOMM: 'ketshup' # SNMP community name.
> LOCALAS: 9200 # Local AS of Cisco sending data.
> COLLECT: { protocol, portmatrix, ifmatrix, nexthop, netmatrix,
> asmatrix,
> tos, flows }
> }
>
> So, Cflowd genarated only one file in /var/arts/data/cflowd/flows every 5 min
> and Flowscan+JKFlow did their work.
>
> Now, I switched from cflowd to flow-tools and I dont know how to configure
> flow-capture it to take flows from more that one exporter using differents
> udp
> ports and generate only one file ft-xxxxx in /var/arts/data/cflowd/flows!!!!
>
> Can you help me to do this srcipt? or I am going to switch to cflowd again!
You should execute multiple flow-fanout. Also look for -L swith in
flow-capture for executing custom "rotate" script on flows file
(flow-capture passes filename as first argument to this script).
--
Andrew Degtiariov
DA-RIPE
_______________________________________________
Flow-tools mailing list
[EMAIL PROTECTED]
http://mailman.splintered.net/mailman/listinfo/flow-tools
