Peter
Sorry about the previous empty email. Anyway, I verified that nfsen has
started. It tells me that it is already started. There are several nfcapd
processes. I checked to see if nfsend is running, which it is. Although
there are two processes called nfsend and no process called nfsend.comm.
conf.php is pointing to the correct file location and I have verified that
nfsend.comm and nfsend.pid have the correct permissions.
Jon.
On 8/16/07, Peter Haag <[EMAIL PROTECTED]> wrote:
>
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
>
>
> - --On August 16, 2007 10:11:30 -0400 Jon Spinney <
> [EMAIL PROTECTED]> wrote:
>
> | I am running Fedora 6.
> | I am running PHP version 5.1.6-3.6.fc6
> | I am running Apache 2.2.4
>
> Have you started NfSen with ./nfsen start
> You should see a process nfsend and nfsend-comm, along several nfcapd, one
> for each
> source.
>
> The comm socket is by default in $BASEDIR/var/run/nfsen.comm
>
> PHP looks in conf.php for the path.
>
> - Peter
>
>
> |
> | Thanks for the assistance.
> |
> | Jon
> |
> | On 8/16/07, Peter Haag <[EMAIL PROTECTED]> wrote:
> | >
> | > -----BEGIN PGP SIGNED MESSAGE-----
> | > Hash: SHA1
> | >
> | >
> | >
> | > - --On August 16, 2007 9:32:33 -0400 Jon Spinney <
> | > [EMAIL PROTECTED]> wrote:
> | >
> | > | OK, I have upgraded my nfsen and nfdump to the latest snapshot and
> am
> | > | getting the same error that started this discussion. Unfortunately,
> I
> | > have
> | > | read through this thread several times and am still having
> difficulty.
> | > | (Sorry for being slow). I have verified permissions on nfsen.command
> | > have
> | > | changed it to both my netflow account and the web account with no
> | > luck. I
> | > | am still getting
> | > |
> | > | ERROR: nfsend connect() error: No such file or directory!
> | > | ERROR: nfsend - connection failed!!
> | > | ERROR: Can not initialize globals!
> | >
> | > What OS, PHP apache are you using?
> | >
> | > - Peter
> | > |
> | > | Can someone spell out what is causing my problem and how to resolve
> it.
> | > |
> | > | Thanks for the help.
> | > |
> | > | Jon
> | > |
> | > | On 8/13/07, Peter Haag <[EMAIL PROTECTED]> wrote:
> | > | >
> | > | > -----BEGIN PGP SIGNED MESSAGE-----
> | > | > Hash: SHA1
> | > | >
> | > | >
> | > | >
> | > | > - --On August 13, 2007 8:52:47 +0200 Felix Schueren <
> | > | > [EMAIL PROTECTED]>
> | > | > wrote:
> | > | >
> | > | > | Peter Haag wrote:
> | > | > | >
> | > | > | >
> | > | > | > --On August 13, 2007 8:38:32 +0200 Felix Schueren <
> | > | > [EMAIL PROTECTED]>
> | > | > | > wrote:
> | > | > | >
> | > | > | > | Eric Cables wrote:
> | > | > | > | > I was able to get conf.php installed after fixing my
> | > setlogsock
> | > | > options, but
> | > | > | > | > that doesn't explain the errors I'm getting when accessing
> | > | > nfsen.php.
> | > | > | > | >
> | > | > | > | > ERROR: nfsend connect() error: No such file or directory!
> | > ERROR:
> | > | > nfsend -
> | > | > | > | > connection failed!! ERROR: Can not initialize globals!What
> | > file is
> | > | > it
> | > | > | > | > looking for that it can't find? What connection is
> failing,
> | > | > nfsend is
> | > | > | > | > running.
> | > | > | > | >
> | > | > | > | I'm guessing it is looking for
> | > | > | > | # nfsend communication socket
> | > | > | > | # $COMMSOCKET = "$PIDDIR/nfsen.comm";
> | > | > | > |
> | > | > | > | which means
> | > | > | > | #
> | > | > | > | # directory for all pid files
> | > | > | > | # $PIDDIR="$VARDIR/run";
> | > | > | > |
> | > | > | > | (on a default install), so if you've installed nfsen to
> | > | > | > | /usr/local/nfsen, then it should be
> | > /usr/local/nfsen/run/nfsen.comm,
> | > | > and
> | > | > | > | it probably needs +rw for both the webserver and nfsen UIDs.
> | > | > | >
> | > | > | > No - the webserver has nothing to do with $PIDDIR.
> | > | > | >
> | > | > | on my default install (only changed prefix) my conf.php for the
> web
> | > | > | frontend has:
> | > | > |
> | > | > | [EMAIL PROTECTED]:/var/flows/nfsen/www# cat conf.php
> | > | > | <?
> | > | > | /* This file was automatically created by the NfSen
> install.plscript */
> | > | > |
> | > | > | $COMMSOCKET = "/var/flows/nfsen/var/run/nfsen.comm";
> | > | >
> | > | > That's $COMMSOCKET and not $PIDDIR. The default install puts it
> into
> | > the
> | > | > same
> | > | > directory. So I agree, that $COMMSOCKET needs web server rw
> access,
> | > which
> | > | > is set by
> | > | > nfsend.
> | > | >
> | > | > - Peter
> | > | >
> | > | >
> | > | > |
> | > | > | $DEBUG=0;
> | > | > |
> | > | > | ?>
> | > | > |
> | > | > | [EMAIL PROTECTED]:/var/flows/nfsen/var/run# ls -la
> | > | > | total 12
> | > | > | drwxrwxr-x 2 nfsen www-data 85 2007-08-03 16:45 .
> | > | > | drwxrwxr-x 6 nfsen www-data 50 2007-08-02 09:12 ..
> | > | > | -rw-r--r-- 1 nfsen www-data 6 2007-08-02 13:56
> jc_blue_cgn1.pid
> | > | > | -rw-r--r-- 1 nfsen www-data 6 2007-08-02 13:56
> jcore1_cgn2.pid
> | > | > | srw-rw---- 1 nfsen www-data 0 2007-08-03 15:28 nfsen.comm
> | > | > | -rw-r--r-- 1 nfsen www-data 6 2007-08-03 15:28 nfsend.pid
> | > | > |
> | > | > |
> | > | > | as the nfcapd collector pids have nothing to do with the
> operation
> | > of
> | > | > | the frontend, these don't matter, but the web server will need
> write
> | > | > | access to the pipe nfsen.comm, won't it?
> | > | > |
> | > | > |
> | > | > | regards,
> | > | > |
> | > | > | Felix
> | > | > |
> | > | > |
> | > | > | --
> | > | > | Felix Schueren, Head of NOC
> | > | > |
> | > | > | mailto:[EMAIL PROTECTED]
> | > | > |
> | > | > | Host Europe GmbH - http://www.hosteurope.de
> | > | > | Welserstrasse 14 - D-51149 Koeln - Germany
> | > | > | Telefon (0800) 4678387 - Telefax (01805) 663233
> | > | > | HRB 28495 Amtsgericht Koeln - UST ID DE187370678
> | > | > | Geschaeftsfuehrer U. Braun - M. Read - S. Porter
> | > | > |
> | > | > | Fuer diese Nachricht gilt:
> http://www.hosteurope.de/disclaimer.html
> | > | >
> | > | >
> | > | >
> | > | > - --
> | > | > _______ SWITCH - The Swiss Education and Research Network ______
> | > | > Peter Haag, Security Engineer, Member of SWITCH CERT
> | > | > PGP fingerprint: D9 31 D5 83 03 95 68 BA FB 84 CA 94 AB FC 5D D7
> | > | > SWITCH, Werdstrasse 2, P.O. Box, CH-8021 Zurich, Switzerland
> | > | > E-mail: [EMAIL PROTECTED] Web: http://www.switch.ch/
> | > | > -----BEGIN PGP SIGNATURE-----
> | > | > Version: GnuPG v1.4.3 (Darwin)
> | > | >
> | > | > iQCVAwUBRsANvf5AbZRALNr/AQK4qAQAmXVvkL4h73/qt1EAw4teUeZxM1UDXnW2
> | > | > 322Gwhle0BKY+Jlvf/anEySK48tm0dc/WHY7Zp1LCgoCOi0A5xpLDAOBkaHVQHov
> | > | > p8efzVBLIBdf64z1O+uL6/yaA13fLAWN8d0NY/RfoEicGonxo3Ewy7hpRb2EEVez
> | > | > 4WxBEEgAuOE=
> | > | > =lJPr
> | > | > -----END PGP SIGNATURE-----
> | > | >
> | > | >
> | > | >
> | >
> -------------------------------------------------------------------------
> | > | > This SF.net email is sponsored by: Splunk Inc.
> | > | > Still grepping through log files to find problems? Stop.
> | > | > Now Search log events and configuration files using AJAX and a
> | > browser.
> | > | > Download your FREE copy of Splunk now >> http://get.splunk.com/
> | > | > _______________________________________________
> | > | > Nfsen-discuss mailing list
> | > | > Nfsen-discuss@lists.sourceforge.net
> | > | > https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
> | > | >
> | >
> | >
> | >
> | > - --
> | > _______ SWITCH - The Swiss Education and Research Network ______
> | > Peter Haag, Security Engineer, Member of SWITCH CERT
> | > PGP fingerprint: D9 31 D5 83 03 95 68 BA FB 84 CA 94 AB FC 5D D7
> | > SWITCH, Werdstrasse 2, P.O. Box, CH-8021 Zurich, Switzerland
> | > E-mail: [EMAIL PROTECTED] Web: http://www.switch.ch/
> | > -----BEGIN PGP SIGNATURE-----
> | > Version: GnuPG v1.4.3 (Darwin)
> | >
> | > iQCVAwUBRsRX0/5AbZRALNr/AQIgcQP9G2H3T/FuqV/Xrq/lZNE5DLwC7EratqHX
> | > MwUPMweMrkn6RVqgqh+lXdc71HKodXpAgfiUwc1SC2orpkqrAmQppgd+19dTS2H4
> | > MT9Z8OO4wN57XYoJrHQCCwxAqMtz4k/um+Qw7bXqRVTX+VK4ApzzL9Pifx26wcQ8
> | > PgGf9hRz2hA=
> | > =ZjOU
> | > -----END PGP SIGNATURE-----
> | >
> | >
>
>
>
> - --
> _______ SWITCH - The Swiss Education and Research Network ______
> Peter Haag, Security Engineer, Member of SWITCH CERT
> PGP fingerprint: D9 31 D5 83 03 95 68 BA FB 84 CA 94 AB FC 5D D7
> SWITCH, Werdstrasse 2, P.O. Box, CH-8021 Zurich, Switzerland
> E-mail: [EMAIL PROTECTED] Web: http://www.switch.ch/
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.3 (Darwin)
>
> iQCVAwUBRsRiav5AbZRALNr/AQKJigP+OUYDco8IpC61iq/Wzg4zo44uw+KemKVd
> Hn7JJtVFVY/iLIt7ziJrjvwngkIVfF7hdm+BaWsV+78Jp5d9NzmpF9mO6+5LLH/h
> nlwd5NOlhjUm+MMthCWNpWC3C6B65XeAW0jnsiqRynB5BBsh6hJF+J6AVgHPTDhF
> uy/cd1cfOI8=
> =UcEj
> -----END PGP SIGNATURE-----
>
>
-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
Nfsen-discuss mailing list
Nfsen-discuss@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
