-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- --On August 16, 2007 11:06:15 -0400 Jon Spinney <[EMAIL PROTECTED]> wrote:
| Peter
|
| Sorry about the previous empty email. Anyway, I verified that nfsen has
| started. It tells me that it is already started. There are several nfcapd
| processes. I checked to see if nfsend is running, which it is. Although
| there are two processes called nfsend and no process called nfsend.comm.
ok - the name can not be changed on some systems. That is ok.
| conf.php is pointing to the correct file location and I have verified that
| nfsend.comm and nfsend.pid have the correct permissions.
what's the output of
./nfsen status
./nfsen -A
- Peter
|
| Jon.
|
|
| On 8/16/07, Peter Haag <[EMAIL PROTECTED]> wrote:
| >
| > -----BEGIN PGP SIGNED MESSAGE-----
| > Hash: SHA1
| >
| >
| >
| > - --On August 16, 2007 10:11:30 -0400 Jon Spinney <
| > [EMAIL PROTECTED]> wrote:
| >
| > | I am running Fedora 6.
| > | I am running PHP version 5.1.6-3.6.fc6
| > | I am running Apache 2.2.4
| >
| > Have you started NfSen with ./nfsen start
| > You should see a process nfsend and nfsend-comm, along several nfcapd, one
| > for each
| > source.
| >
| > The comm socket is by default in $BASEDIR/var/run/nfsen.comm
| >
| > PHP looks in conf.php for the path.
| >
| > - Peter
| >
| >
| > |
| > | Thanks for the assistance.
| > |
| > | Jon
| > |
| > | On 8/16/07, Peter Haag <[EMAIL PROTECTED]> wrote:
| > | >
| > | > -----BEGIN PGP SIGNED MESSAGE-----
| > | > Hash: SHA1
| > | >
| > | >
| > | >
| > | > - --On August 16, 2007 9:32:33 -0400 Jon Spinney <
| > | > [EMAIL PROTECTED]> wrote:
| > | >
| > | > | OK, I have upgraded my nfsen and nfdump to the latest snapshot and
| > am
| > | > | getting the same error that started this discussion. Unfortunately,
| > I
| > | > have
| > | > | read through this thread several times and am still having
| > difficulty.
| > | > | (Sorry for being slow). I have verified permissions on nfsen.command
| > | > have
| > | > | changed it to both my netflow account and the web account with no
| > | > luck. I
| > | > | am still getting
| > | > |
| > | > | ERROR: nfsend connect() error: No such file or directory!
| > | > | ERROR: nfsend - connection failed!!
| > | > | ERROR: Can not initialize globals!
| > | >
| > | > What OS, PHP apache are you using?
| > | >
| > | > - Peter
| > | > |
| > | > | Can someone spell out what is causing my problem and how to resolve
| > it.
| > | > |
| > | > | Thanks for the help.
| > | > |
| > | > | Jon
| > | > |
| > | > | On 8/13/07, Peter Haag <[EMAIL PROTECTED]> wrote:
| > | > | >
| > | > | > -----BEGIN PGP SIGNED MESSAGE-----
| > | > | > Hash: SHA1
| > | > | >
| > | > | >
| > | > | >
| > | > | > - --On August 13, 2007 8:52:47 +0200 Felix Schueren <
| > | > | > [EMAIL PROTECTED]>
| > | > | > wrote:
| > | > | >
| > | > | > | Peter Haag wrote:
| > | > | > | >
| > | > | > | >
| > | > | > | > --On August 13, 2007 8:38:32 +0200 Felix Schueren <
| > | > | > [EMAIL PROTECTED]>
| > | > | > | > wrote:
| > | > | > | >
| > | > | > | > | Eric Cables wrote:
| > | > | > | > | > I was able to get conf.php installed after fixing my
| > | > setlogsock
| > | > | > options, but
| > | > | > | > | > that doesn't explain the errors I'm getting when accessing
| > | > | > nfsen.php.
| > | > | > | > | >
| > | > | > | > | > ERROR: nfsend connect() error: No such file or directory!
| > | > ERROR:
| > | > | > nfsend -
| > | > | > | > | > connection failed!! ERROR: Can not initialize globals!What
| > | > file is
| > | > | > it
| > | > | > | > | > looking for that it can't find? What connection is
| > failing,
| > | > | > nfsend is
| > | > | > | > | > running.
| > | > | > | > | >
| > | > | > | > | I'm guessing it is looking for
| > | > | > | > | # nfsend communication socket
| > | > | > | > | # $COMMSOCKET = "$PIDDIR/nfsen.comm";
| > | > | > | > |
| > | > | > | > | which means
| > | > | > | > | #
| > | > | > | > | # directory for all pid files
| > | > | > | > | # $PIDDIR="$VARDIR/run";
| > | > | > | > |
| > | > | > | > | (on a default install), so if you've installed nfsen to
| > | > | > | > | /usr/local/nfsen, then it should be
| > | > /usr/local/nfsen/run/nfsen.comm,
| > | > | > and
| > | > | > | > | it probably needs +rw for both the webserver and nfsen UIDs.
| > | > | > | >
| > | > | > | > No - the webserver has nothing to do with $PIDDIR.
| > | > | > | >
| > | > | > | on my default install (only changed prefix) my conf.php for the
| > web
| > | > | > | frontend has:
| > | > | > |
| > | > | > | [EMAIL PROTECTED]:/var/flows/nfsen/www# cat conf.php
| > | > | > | <?
| > | > | > | /* This file was automatically created by the NfSen
| > install.plscript */
| > | > | > |
| > | > | > | $COMMSOCKET = "/var/flows/nfsen/var/run/nfsen.comm";
| > | > | >
| > | > | > That's $COMMSOCKET and not $PIDDIR. The default install puts it
| > into
| > | > the
| > | > | > same
| > | > | > directory. So I agree, that $COMMSOCKET needs web server rw
| > access,
| > | > which
| > | > | > is set by
| > | > | > nfsend.
| > | > | >
| > | > | > - Peter
| > | > | >
| > | > | >
| > | > | > |
| > | > | > | $DEBUG=0;
| > | > | > |
| > | > | > | ?>
| > | > | > |
| > | > | > | [EMAIL PROTECTED]:/var/flows/nfsen/var/run# ls -la
| > | > | > | total 12
| > | > | > | drwxrwxr-x 2 nfsen www-data 85 2007-08-03 16:45 .
| > | > | > | drwxrwxr-x 6 nfsen www-data 50 2007-08-02 09:12 ..
| > | > | > | -rw-r--r-- 1 nfsen www-data 6 2007-08-02 13:56
| > jc_blue_cgn1.pid
| > | > | > | -rw-r--r-- 1 nfsen www-data 6 2007-08-02 13:56
| > jcore1_cgn2.pid
| > | > | > | srw-rw---- 1 nfsen www-data 0 2007-08-03 15:28 nfsen.comm
| > | > | > | -rw-r--r-- 1 nfsen www-data 6 2007-08-03 15:28 nfsend.pid
| > | > | > |
| > | > | > |
| > | > | > | as the nfcapd collector pids have nothing to do with the
| > operation
| > | > of
| > | > | > | the frontend, these don't matter, but the web server will need
| > write
| > | > | > | access to the pipe nfsen.comm, won't it?
| > | > | > |
| > | > | > |
| > | > | > | regards,
| > | > | > |
| > | > | > | Felix
| > | > | > |
| > | > | > |
| > | > | > | --
| > | > | > | Felix Schueren, Head of NOC
| > | > | > |
| > | > | > | mailto:[EMAIL PROTECTED]
| > | > | > |
| > | > | > | Host Europe GmbH - http://www.hosteurope.de
| > | > | > | Welserstrasse 14 - D-51149 Koeln - Germany
| > | > | > | Telefon (0800) 4678387 - Telefax (01805) 663233
| > | > | > | HRB 28495 Amtsgericht Koeln - UST ID DE187370678
| > | > | > | Geschaeftsfuehrer U. Braun - M. Read - S. Porter
| > | > | > |
| > | > | > | Fuer diese Nachricht gilt:
| > http://www.hosteurope.de/disclaimer.html
| > | > | >
| > | > | >
| > | > | >
| > | > | > - --
| > | > | > _______ SWITCH - The Swiss Education and Research Network ______
| > | > | > Peter Haag, Security Engineer, Member of SWITCH CERT
| > | > | > PGP fingerprint: D9 31 D5 83 03 95 68 BA FB 84 CA 94 AB FC 5D D7
| > | > | > SWITCH, Werdstrasse 2, P.O. Box, CH-8021 Zurich, Switzerland
| > | > | > E-mail: [EMAIL PROTECTED] Web: http://www.switch.ch/
| > | > | > -----BEGIN PGP SIGNATURE-----
| > | > | > Version: GnuPG v1.4.3 (Darwin)
| > | > | >
| > | > | > iQCVAwUBRsANvf5AbZRALNr/AQK4qAQAmXVvkL4h73/qt1EAw4teUeZxM1UDXnW2
| > | > | > 322Gwhle0BKY+Jlvf/anEySK48tm0dc/WHY7Zp1LCgoCOi0A5xpLDAOBkaHVQHov
| > | > | > p8efzVBLIBdf64z1O+uL6/yaA13fLAWN8d0NY/RfoEicGonxo3Ewy7hpRb2EEVez
| > | > | > 4WxBEEgAuOE=
| > | > | > =lJPr
| > | > | > -----END PGP SIGNATURE-----
| > | > | >
| > | > | >
| > | > | >
| > | >
| > -------------------------------------------------------------------------
| > | > | > This SF.net email is sponsored by: Splunk Inc.
| > | > | > Still grepping through log files to find problems? Stop.
| > | > | > Now Search log events and configuration files using AJAX and a
| > | > browser.
| > | > | > Download your FREE copy of Splunk now >> http://get.splunk.com/
| > | > | > _______________________________________________
| > | > | > Nfsen-discuss mailing list
| > | > | > Nfsen-discuss@lists.sourceforge.net
| > | > | > https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
| > | > | >
| > | >
| > | >
| > | >
| > | > - --
| > | > _______ SWITCH - The Swiss Education and Research Network ______
| > | > Peter Haag, Security Engineer, Member of SWITCH CERT
| > | > PGP fingerprint: D9 31 D5 83 03 95 68 BA FB 84 CA 94 AB FC 5D D7
| > | > SWITCH, Werdstrasse 2, P.O. Box, CH-8021 Zurich, Switzerland
| > | > E-mail: [EMAIL PROTECTED] Web: http://www.switch.ch/
| > | > -----BEGIN PGP SIGNATURE-----
| > | > Version: GnuPG v1.4.3 (Darwin)
| > | >
| > | > iQCVAwUBRsRX0/5AbZRALNr/AQIgcQP9G2H3T/FuqV/Xrq/lZNE5DLwC7EratqHX
| > | > MwUPMweMrkn6RVqgqh+lXdc71HKodXpAgfiUwc1SC2orpkqrAmQppgd+19dTS2H4
| > | > MT9Z8OO4wN57XYoJrHQCCwxAqMtz4k/um+Qw7bXqRVTX+VK4ApzzL9Pifx26wcQ8
| > | > PgGf9hRz2hA=
| > | > =ZjOU
| > | > -----END PGP SIGNATURE-----
| > | >
| > | >
| >
| >
| >
| > - --
| > _______ SWITCH - The Swiss Education and Research Network ______
| > Peter Haag, Security Engineer, Member of SWITCH CERT
| > PGP fingerprint: D9 31 D5 83 03 95 68 BA FB 84 CA 94 AB FC 5D D7
| > SWITCH, Werdstrasse 2, P.O. Box, CH-8021 Zurich, Switzerland
| > E-mail: [EMAIL PROTECTED] Web: http://www.switch.ch/
| > -----BEGIN PGP SIGNATURE-----
| > Version: GnuPG v1.4.3 (Darwin)
| >
| > iQCVAwUBRsRiav5AbZRALNr/AQKJigP+OUYDco8IpC61iq/Wzg4zo44uw+KemKVd
| > Hn7JJtVFVY/iLIt7ziJrjvwngkIVfF7hdm+BaWsV+78Jp5d9NzmpF9mO6+5LLH/h
| > nlwd5NOlhjUm+MMthCWNpWC3C6B65XeAW0jnsiqRynB5BBsh6hJF+J6AVgHPTDhF
| > uy/cd1cfOI8=
| > =UcEj
| > -----END PGP SIGNATURE-----
| >
| >
- --
_______ SWITCH - The Swiss Education and Research Network ______
Peter Haag, Security Engineer, Member of SWITCH CERT
PGP fingerprint: D9 31 D5 83 03 95 68 BA FB 84 CA 94 AB FC 5D D7
SWITCH, Werdstrasse 2, P.O. Box, CH-8021 Zurich, Switzerland
E-mail: [EMAIL PROTECTED] Web: http://www.switch.ch/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (Darwin)
iQCVAwUBRsRofP5AbZRALNr/AQJuPwP7BZgtwHkyMICVEc89n4Qk3n17vW8upXZt
xUtTBtU9ZLkkiAfFPwf8D2+w4B9y2kLHttZE3tSQdF4ZxecmXXAvz2GHtnQXGS9n
935T/3mV1SvzL4ZHtvUx9rNlo020pEb1YUEk8LoLH9HvLNWeLifPs7tdObGVA1Nk
KB2GTf0txUU=
=fXJL
-----END PGP SIGNATURE-----
-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
Nfsen-discuss mailing list
Nfsen-discuss@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
