I had Nfsen working just fine when all the 6509s were sending all Netflow data
to a single port but now that I have each sending their data to different ports
I no longer get updated data in profiles that I create.
The only profile that works is live.
Any ideas on what might be wrong?
Thanks
Steve
Here is an excerpt of my log file since the change:
May 27 04:02:09 scorpious syslogd 1.4.1: restart.
May 27 04:05:00 scorpious /usr/local/bin/nfcapd[6264]: Ident: 'CABHUBROU125T-1'
Flows: 6679, Packets: 18125, Bytes: 1856207, Sequence Errors: 0, Bad Packets:
0
May 27 04:05:00 scorpious /usr/local/bin/nfcapd[6255]: Ident: 'HUGHUBROU033-1'
Flows: 5916, Packets: 15429, Bytes: 1640864, Sequence Errors: 0, Bad Packets:
0
May 27 04:05:00 scorpious /usr/local/bin/nfcapd[6258]: Ident: 'CABHUBROU125T-2'
Flows: 7182, Packets: 80270, Bytes: 15596096, Sequence Errors: 0, Bad Packets
: 0
May 27 04:05:01 scorpious /usr/local/bin/nfcapd[6252]: Ident: 'MOSHUBROU125-1'
Flows: 537, Packets: 1856, Bytes: 170475, Sequence Errors: 0, Bad Packets: 0
May 27 04:05:01 scorpious /usr/local/bin/nfcapd[6267]: Ident: 'UPHHUBROU035B-1'
Flows: 4987, Packets: 74728, Bytes: 15583665, Sequence Errors: 0, Bad Packets
: 0
May 27 04:05:03 scorpious /usr/local/bin/nfcapd[6270]: Ident: 'HYTHUBROU114-1'
Flows: 95, Packets: 1308, Bytes: 353559, Sequence Errors: 0, Bad Packets: 0
May 27 04:05:05 scorpious /usr/local/bin/nfcapd[6273]: Ident: 'JHNHUNROU057-1'
Flows: 388, Packets: 1737, Bytes: 245589, Sequence Errors: 0, Bad Packets: 0
May 27 04:05:05 scorpious /usr/local/bin/nfcapd[6261]: Ident: 'HYTHUBROU004-1'
Flows: 1328, Packets: 4612, Bytes: 522122, Sequence Errors: 0, Bad Packets: 0
May 27 04:05:15 scorpious nfsen[6275]: 57 channels/alerts to profile
May 27 04:05:15 scorpious nfsen[6275]: Update profile FTP in group .
May 27 04:05:15 scorpious nfsen[6275]: Error reading channel stat information.
Mising key 'first'
May 27 04:05:15 scorpious last message repeated 7 times
May 27 04:05:16 scorpious nfsen[6275]: Update profile HTTP in group .
May 27 04:05:16 scorpious nfsen[6275]: Error reading channel stat information.
Mising key 'first'
May 27 04:05:16 scorpious last message repeated 7 times
May 27 04:05:17 scorpious nfsen[6275]: Update profile HTTPS in group .
May 27 04:05:17 scorpious nfsen[6275]: Error reading channel stat information.
Mising key 'first'
May 27 04:05:17 scorpious last message repeated 7 times
May 27 04:05:17 scorpious nfsen[6275]: Update profile MSSQL in group .
May 27 04:05:17 scorpious nfsen[6275]: Error reading channel stat information.
Mising key 'first'
May 27 04:05:17 scorpious last message repeated 7 times
May 27 04:05:18 scorpious nfsen[6275]: Update profile SSH in group .
May 27 04:05:18 scorpious nfsen[6275]: Error reading channel stat information.
Mising key 'first'
May 27 04:05:18 scorpious last message repeated 7 times
May 27 04:05:19 scorpious nfsen[6275]: Update profile Telnet in group .
May 27 04:05:19 scorpious nfsen[6275]: Error reading channel stat information.
Mising key 'first'
May 27 04:05:19 scorpious last message repeated 7 times
May 27 04:05:19 scorpious nfsen[6275]: Update profile Test in group .
May 27 04:05:19 scorpious nfsen[6275]: Error reading channel stat information.
Mising key 'first'
May 27 04:05:20 scorpious nfsen[6275]: Update profile VNC in group .
May 27 04:05:20 scorpious nfsen[6275]: Error reading channel stat information.
Mising key 'first'
May 27 04:05:20 scorpious last message repeated 7 times
May 27 04:05:20 scorpious nfsen[6275]: Update profile live in group .
May 27 04:05:21 scorpious nfsen[6276]: comm server started: 12730
May 27 04:05:21 scorpious nfsen[6275]: Run expire at Sun May 27 04:05:00 2007
May 27 04:05:21 scorpious nfsen[6275]: Expire profile FTP group . low water
mark: 0.9%%
May 27 04:05:21 scorpious nfsen[6275]: Expire profile HTTP group . low water
mark: 0.9%%
May 27 04:05:21 scorpious nfsen[6275]: Expire profile HTTPS group . low water
mark: 0.9%%
May 27 04:05:21 scorpious nfsen[6275]: Expire profile MSSQL group . low water
mark: 0.9%%
May 27 04:05:21 scorpious nfsen[6275]: Expire profile SSH group . low water
mark: 0.9%%
May 27 04:05:21 scorpious nfsen[6275]: Expire profile Telnet group . low water
mark: 0.9%%
May 27 04:05:21 scorpious nfsen[6275]: Expire profile Test group . low water
mark: 0.9%%
May 27 04:05:21 scorpious nfsen[6275]: Expire profile VNC group . low water
mark: 0.9%%
May 27 04:05:21 scorpious nfsen[6275]: Expire profile live group . low water
mark: 0.9%%
May 27 04:05:21 scorpious nfsen[6275]: End expire at Sun May 27 04:05:00 2007
May 27 04:10:00 scorpious /usr/local/bin/nfcapd[6264]: Ident: 'CABHUBROU125T-1'
Flows: 6869, Packets: 16966, Bytes: 1686362, Sequence Errors: 0, Bad Packets:
0
May 27 04:10:01 scorpious /usr/local/bin/nfcapd[6258]: Ident: 'CABHUBROU125T-2'
Flows: 6171, Packets: 18273, Bytes: 1951152, Sequence Errors: 0, Bad Packets:
0
May 27 04:10:01 scorpious /usr/local/bin/nfcapd[6255]: Ident: 'HUGHUBROU033-1'
Flows: 5950, Packets: 15229, Bytes: 1617573, Sequence Errors: 0, Bad Packets:
0
May 27 04:10:02 scorpious /usr/local/bin/nfcapd[6267]: Ident: 'UPHHUBROU035B-1'
Flows: 5080, Packets: 13374, Bytes: 1704872, Sequence Errors: 0, Bad Packets:
0
May 27 04:10:02 scorpious /usr/local/bin/nfcapd[6261]: Ident: 'HYTHUBROU004-1'
Flows: 1350, Packets: 3696, Bytes: 463768, Sequence Errors: 0, Bad Packets: 0
May 27 04:10:03 scorpious /usr/local/bin/nfcapd[6270]: Ident: 'HYTHUBROU114-1'
Flows: 103, Packets: 794, Bytes: 273674, Sequence Errors: 0, Bad Packets: 0
Stephen W. Bradley GCIH CISSP
Network Security Specialist
Miami University
Information Security Office
513-529-8129
[EMAIL PROTECTED]
"Those who would give up essential liberty to purchase a little temporary
safety deserve neither liberty nor safety."
Benjamin Franklin, Historical Review of Pennsylvania, 1759
-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/
_______________________________________________
Nfsen-discuss mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
