Since I'm experiencing the same problems, and we've got our own thread
going, Peter, I'll just start replying to this instead. While it may be my
environment that's the problem, apparently others are having the same
problem....
# ./nfsen status
NfSen version: 1.3b-20070720
NfSen status:
Collector for 'sdhqir0201' is running: 24792.
Collector for 'sdhqcs0201' is running: 24803.
Collector for 'sdhqir0202' is running: 24810.
Collector for 'sdhqcs0202' is running: 24920.
nfsen daemon: pid: [24971] is running.
# ./nfsen -A
live
I also do not see any processes named "nfsend-comm"
# ps -ef | grep nf
root 9 1 0 Oct 24 ? 5:43 /lib/svc/bin/svc.configd
netflow 24792 1 0 Aug 13 ? 0:11 /usr/local/bin/nfcapd -w
-D -I sdhqir0201 -p 9995 -u netflow -g nobody -B 20000
netflow 24972 24971 0 Aug 13 ? 0:05 /usr/local/bin/perl -w
/usr/local/nfsen/bin/nfsend
netflow 24803 1 0 Aug 13 ? 0:01 /usr/local/bin/nfcapd -w
-D -I sdhqcs0201 -p 9997 -u netflow -g nobody -B 20000
netflow 24920 1 0 Aug 13 ? 0:01 /usr/local/bin/nfcapd -w
-D -I sdhqcs0202 -p 9998 -u netflow -g nobody -B 20000
netflow 24810 1 0 Aug 13 ? 0:13 /usr/local/bin/nfcapd -w
-D -I sdhqir0202 -p 9996 -u netflow -g nobody -B 20000
netflow 24971 1 0 Aug 13 ? 16:54 /usr/local/bin/perl -w
/usr/local/nfsen/bin/nfsend
On 8/16/07, Peter Haag <[EMAIL PROTECTED]> wrote:
>
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
>
>
> - --On August 16, 2007 11:06:15 -0400 Jon Spinney <
> [EMAIL PROTECTED]> wrote:
>
> | Peter
> |
> | Sorry about the previous empty email. Anyway, I verified that nfsen
> has
> | started. It tells me that it is already started. There are several
> nfcapd
> | processes. I checked to see if nfsend is running, which it
> is. Although
> | there are two processes called nfsend and no process called nfsend.comm.
>
> ok - the name can not be changed on some systems. That is ok.
>
> | conf.php is pointing to the correct file location and I have verified
> that
> | nfsend.comm and nfsend.pid have the correct permissions.
>
> what's the output of
>
> ./nfsen status
>
> ./nfsen -A
>
> - Peter
>
> |
> | Jon.
> |
> |
> | On 8/16/07, Peter Haag <[EMAIL PROTECTED]> wrote:
> | >
> | > -----BEGIN PGP SIGNED MESSAGE-----
> | > Hash: SHA1
> | >
> | >
> | >
> | > - --On August 16, 2007 10:11:30 -0400 Jon Spinney <
> | > [EMAIL PROTECTED]> wrote:
> | >
> | > | I am running Fedora 6.
> | > | I am running PHP version 5.1.6-3.6.fc6
> | > | I am running Apache 2.2.4
> | >
> | > Have you started NfSen with ./nfsen start
> | > You should see a process nfsend and nfsend-comm, along several nfcapd,
> one
> | > for each
> | > source.
> | >
> | > The comm socket is by default in $BASEDIR/var/run/nfsen.comm
> | >
> | > PHP looks in conf.php for the path.
> | >
> | > - Peter
> | >
> | >
> | > |
> | > | Thanks for the assistance.
> | > |
> | > | Jon
> | > |
> | > | On 8/16/07, Peter Haag <[EMAIL PROTECTED]> wrote:
> | > | >
> | > | > -----BEGIN PGP SIGNED MESSAGE-----
> | > | > Hash: SHA1
> | > | >
> | > | >
> | > | >
> | > | > - --On August 16, 2007 9:32:33 -0400 Jon Spinney <
> | > | > [EMAIL PROTECTED]> wrote:
> | > | >
> | > | > | OK, I have upgraded my nfsen and nfdump to the latest snapshot
> and
> | > am
> | > | > | getting the same error that started this
> discussion. Unfortunately,
> | > I
> | > | > have
> | > | > | read through this thread several times and am still having
> | > difficulty.
> | > | > | (Sorry for being slow). I have verified permissions on
> nfsen.command
> | > | > have
> | > | > | changed it to both my netflow account and the web account with
> no
> | > | > luck. I
> | > | > | am still getting
> | > | > |
> | > | > | ERROR: nfsend connect() error: No such file or directory!
> | > | > | ERROR: nfsend - connection failed!!
> | > | > | ERROR: Can not initialize globals!
> | > | >
> | > | > What OS, PHP apache are you using?
> | > | >
> | > | > - Peter
> | > | > |
> | > | > | Can someone spell out what is causing my problem and how to
> resolve
> | > it.
> | > | > |
> | > | > | Thanks for the help.
> | > | > |
> | > | > | Jon
> | > | > |
> | > | > | On 8/13/07, Peter Haag <[EMAIL PROTECTED]> wrote:
> | > | > | >
> | > | > | > -----BEGIN PGP SIGNED MESSAGE-----
> | > | > | > Hash: SHA1
> | > | > | >
> | > | > | >
> | > | > | >
> | > | > | > - --On August 13, 2007 8:52:47 +0200 Felix Schueren <
> | > | > | > [EMAIL PROTECTED]>
> | > | > | > wrote:
> | > | > | >
> | > | > | > | Peter Haag wrote:
> | > | > | > | >
> | > | > | > | >
> | > | > | > | > --On August 13, 2007 8:38:32 +0200 Felix Schueren <
> | > | > | > [EMAIL PROTECTED]>
> | > | > | > | > wrote:
> | > | > | > | >
> | > | > | > | > | Eric Cables wrote:
> | > | > | > | > | > I was able to get conf.php installed after fixing my
> | > | > setlogsock
> | > | > | > options, but
> | > | > | > | > | > that doesn't explain the errors I'm getting when
> accessing
> | > | > | > nfsen.php.
> | > | > | > | > | >
> | > | > | > | > | > ERROR: nfsend connect() error: No such file or
> directory!
> | > | > ERROR:
> | > | > | > nfsend -
> | > | > | > | > | > connection failed!! ERROR: Can not initialize
> globals!What
> | > | > file is
> | > | > | > it
> | > | > | > | > | > looking for that it can't find? What connection is
> | > failing,
> | > | > | > nfsend is
> | > | > | > | > | > running.
> | > | > | > | > | >
> | > | > | > | > | I'm guessing it is looking for
> | > | > | > | > | # nfsend communication socket
> | > | > | > | > | # $COMMSOCKET = "$PIDDIR/nfsen.comm";
> | > | > | > | > |
> | > | > | > | > | which means
> | > | > | > | > | #
> | > | > | > | > | # directory for all pid files
> | > | > | > | > | # $PIDDIR="$VARDIR/run";
> | > | > | > | > |
> | > | > | > | > | (on a default install), so if you've installed nfsen to
> | > | > | > | > | /usr/local/nfsen, then it should be
> | > | > /usr/local/nfsen/run/nfsen.comm,
> | > | > | > and
> | > | > | > | > | it probably needs +rw for both the webserver and nfsen
> UIDs.
> | > | > | > | >
> | > | > | > | > No - the webserver has nothing to do with $PIDDIR.
> | > | > | > | >
> | > | > | > | on my default install (only changed prefix) my conf.php for
> the
> | > web
> | > | > | > | frontend has:
> | > | > | > |
> | > | > | > | [EMAIL PROTECTED]:/var/flows/nfsen/www# cat conf.php
> | > | > | > | <?
> | > | > | > | /* This file was automatically created by the NfSen
> | > install.plscript */
> | > | > | > |
> | > | > | > | $COMMSOCKET = "/var/flows/nfsen/var/run/nfsen.comm";
> | > | > | >
> | > | > | > That's $COMMSOCKET and not $PIDDIR. The default install puts
> it
> | > into
> | > | > the
> | > | > | > same
> | > | > | > directory. So I agree, that $COMMSOCKET needs web server rw
> | > access,
> | > | > which
> | > | > | > is set by
> | > | > | > nfsend.
> | > | > | >
> | > | > | > - Peter
> | > | > | >
> | > | > | >
> | > | > | > |
> | > | > | > | $DEBUG=0;
> | > | > | > |
> | > | > | > | ?>
> | > | > | > |
> | > | > | > | [EMAIL PROTECTED]:/var/flows/nfsen/var/run# ls -la
> | > | > | > | total 12
> | > | > | > | drwxrwxr-x 2 nfsen www-data 85 2007-08-03 16:45 .
> | > | > | > | drwxrwxr-x 6 nfsen www-data 50 2007-08-02 09:12 ..
> | > | > | > | -rw-r--r-- 1 nfsen www-data 6 2007-08-02 13:56
> | > jc_blue_cgn1.pid
> | > | > | > | -rw-r--r-- 1 nfsen www-data 6 2007-08-02 13:56
> | > jcore1_cgn2.pid
> | > | > | > | srw-rw---- 1 nfsen www-data 0 2007-08-03 15:28 nfsen.comm
> | > | > | > | -rw-r--r-- 1 nfsen www-data 6 2007-08-03 15:28 nfsend.pid
> | > | > | > |
> | > | > | > |
> | > | > | > | as the nfcapd collector pids have nothing to do with the
> | > operation
> | > | > of
> | > | > | > | the frontend, these don't matter, but the web server will
> need
> | > write
> | > | > | > | access to the pipe nfsen.comm, won't it?
> | > | > | > |
> | > | > | > |
> | > | > | > | regards,
> | > | > | > |
> | > | > | > | Felix
> | > | > | > |
> | > | > | > |
> | > | > | > | --
> | > | > | > | Felix Schueren, Head of NOC
> | > | > | > |
> | > | > | > | mailto:[EMAIL PROTECTED]
> | > | > | > |
> | > | > | > | Host Europe GmbH - http://www.hosteurope.de
> | > | > | > | Welserstrasse 14 - D-51149 Koeln - Germany
> | > | > | > | Telefon (0800) 4678387 - Telefax (01805) 663233
> | > | > | > | HRB 28495 Amtsgericht Koeln - UST ID DE187370678
> | > | > | > | Geschaeftsfuehrer U. Braun - M. Read - S. Porter
> | > | > | > |
> | > | > | > | Fuer diese Nachricht gilt:
> | > http://www.hosteurope.de/disclaimer.html
> | > | > | >
> | > | > | >
> | > | > | >
> | > | > | > - --
> | > | > | > _______ SWITCH - The Swiss Education and Research Network
> ______
> | > | > | > Peter Haag, Security Engineer, Member of SWITCH CERT
> | > | > | > PGP fingerprint: D9 31 D5 83 03 95 68 BA FB 84 CA 94 AB FC 5D
> D7
> | > | > | > SWITCH, Werdstrasse 2, P.O. Box, CH-8021 Zurich,
> Switzerland
> | > | > | > E-mail: [EMAIL PROTECTED] Web: http://www.switch.ch/
> | > | > | > -----BEGIN PGP SIGNATURE-----
> | > | > | > Version: GnuPG v1.4.3 (Darwin)
> | > | > | >
> | > | > | >
> iQCVAwUBRsANvf5AbZRALNr/AQK4qAQAmXVvkL4h73/qt1EAw4teUeZxM1UDXnW2
> | > | > | >
> 322Gwhle0BKY+Jlvf/anEySK48tm0dc/WHY7Zp1LCgoCOi0A5xpLDAOBkaHVQHov
> | > | > | >
> p8efzVBLIBdf64z1O+uL6/yaA13fLAWN8d0NY/RfoEicGonxo3Ewy7hpRb2EEVez
> | > | > | > 4WxBEEgAuOE=
> | > | > | > =lJPr
> | > | > | > -----END PGP SIGNATURE-----
> | > | > | >
> | > | > | >
> | > | > | >
> | > | >
> | >
> -------------------------------------------------------------------------
> | > | > | > This SF.net email is sponsored by: Splunk Inc.
> | > | > | > Still grepping through log files to find problems? Stop.
> | > | > | > Now Search log events and configuration files using AJAX and a
> | > | > browser.
> | > | > | > Download your FREE copy of Splunk now >>
> http://get.splunk.com/
> | > | > | > _______________________________________________
> | > | > | > Nfsen-discuss mailing list
> | > | > | > Nfsen-discuss@lists.sourceforge.net
> | > | > | > https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
> | > | > | >
> | > | >
> | > | >
> | > | >
> | > | > - --
> | > | > _______ SWITCH - The Swiss Education and Research Network ______
> | > | > Peter Haag, Security Engineer, Member of SWITCH CERT
> | > | > PGP fingerprint: D9 31 D5 83 03 95 68 BA FB 84 CA 94 AB FC 5D D7
> | > | > SWITCH, Werdstrasse 2, P.O. Box, CH-8021 Zurich, Switzerland
> | > | > E-mail: [EMAIL PROTECTED] Web: http://www.switch.ch/
> | > | > -----BEGIN PGP SIGNATURE-----
> | > | > Version: GnuPG v1.4.3 (Darwin)
> | > | >
> | > | > iQCVAwUBRsRX0/5AbZRALNr/AQIgcQP9G2H3T/FuqV/Xrq/lZNE5DLwC7EratqHX
> | > | > MwUPMweMrkn6RVqgqh+lXdc71HKodXpAgfiUwc1SC2orpkqrAmQppgd+19dTS2H4
> | > | > MT9Z8OO4wN57XYoJrHQCCwxAqMtz4k/um+Qw7bXqRVTX+VK4ApzzL9Pifx26wcQ8
> | > | > PgGf9hRz2hA=
> | > | > =ZjOU
> | > | > -----END PGP SIGNATURE-----
> | > | >
> | > | >
> | >
> | >
> | >
> | > - --
> | > _______ SWITCH - The Swiss Education and Research Network ______
> | > Peter Haag, Security Engineer, Member of SWITCH CERT
> | > PGP fingerprint: D9 31 D5 83 03 95 68 BA FB 84 CA 94 AB FC 5D D7
> | > SWITCH, Werdstrasse 2, P.O. Box, CH-8021 Zurich, Switzerland
> | > E-mail: [EMAIL PROTECTED] Web: http://www.switch.ch/
> | > -----BEGIN PGP SIGNATURE-----
> | > Version: GnuPG v1.4.3 (Darwin)
> | >
> | > iQCVAwUBRsRiav5AbZRALNr/AQKJigP+OUYDco8IpC61iq/Wzg4zo44uw+KemKVd
> | > Hn7JJtVFVY/iLIt7ziJrjvwngkIVfF7hdm+BaWsV+78Jp5d9NzmpF9mO6+5LLH/h
> | > nlwd5NOlhjUm+MMthCWNpWC3C6B65XeAW0jnsiqRynB5BBsh6hJF+J6AVgHPTDhF
> | > uy/cd1cfOI8=
> | > =UcEj
> | > -----END PGP SIGNATURE-----
> | >
> | >
>
>
>
> - --
> _______ SWITCH - The Swiss Education and Research Network ______
> Peter Haag, Security Engineer, Member of SWITCH CERT
> PGP fingerprint: D9 31 D5 83 03 95 68 BA FB 84 CA 94 AB FC 5D D7
> SWITCH, Werdstrasse 2, P.O. Box, CH-8021 Zurich, Switzerland
> E-mail: [EMAIL PROTECTED] Web: http://www.switch.ch/
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.3 (Darwin)
>
> iQCVAwUBRsRofP5AbZRALNr/AQJuPwP7BZgtwHkyMICVEc89n4Qk3n17vW8upXZt
> xUtTBtU9ZLkkiAfFPwf8D2+w4B9y2kLHttZE3tSQdF4ZxecmXXAvz2GHtnQXGS9n
> 935T/3mV1SvzL4ZHtvUx9rNlo020pEb1YUEk8LoLH9HvLNWeLifPs7tdObGVA1Nk
> KB2GTf0txUU=
> =fXJL
> -----END PGP SIGNATURE-----
>
>
> -------------------------------------------------------------------------
> This SF.net email is sponsored by: Splunk Inc.
> Still grepping through log files to find problems? Stop.
> Now Search log events and configuration files using AJAX and a browser.
> Download your FREE copy of Splunk now >> http://get.splunk.com/
> _______________________________________________
> Nfsen-discuss mailing list
> Nfsen-discuss@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
>
--
Eric Cables
-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
Nfsen-discuss mailing list
Nfsen-discuss@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
