-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- --On August 16, 2007 12:47:12 PM -0400 Jon Spinney <[EMAIL PROTECTED]> wrote:
| # ./nfsen status
| NfSen version: snapshot-20070312
| NfSen status:
| "lists all my collectors and the PIDs"
| nfsen daemon: pid: [29585] is running.
| #
|
| # ./nfsen -A
| live
| #
Everything looks good.
Below you mentioned starting nfsen reports "nfsend is already running"
Please verify by doing:
./nfsen stop
Verify that no orphan or legacy nfsend process from your old installation
is running by checking that in the ps output, otherwise kill all nfsend
processes.
./nfsen start
Check your nfsen syslog and apache error log file for error messages. I know of
properly working Fedora and Solaris setups. Testing over and over again, I can
not reproduce this error.
- Peter
|
|
| On 8/16/07, Peter Haag <[EMAIL PROTECTED]> wrote:
| >
| > -----BEGIN PGP SIGNED MESSAGE-----
| > Hash: SHA1
| >
| >
| >
| > - --On August 16, 2007 11:06:15 -0400 Jon Spinney <
| > [EMAIL PROTECTED]> wrote:
| >
| > | Peter
| > |
| > | Sorry about the previous empty email. Anyway, I verified that nfsen
| > has
| > | started. It tells me that it is already started. There are several
| > nfcapd
| > | processes. I checked to see if nfsend is running, which it
| > is. Although
| > | there are two processes called nfsend and no process called nfsend.comm.
| >
| > ok - the name can not be changed on some systems. That is ok.
| >
| > | conf.php is pointing to the correct file location and I have verified
| > that
| > | nfsend.comm and nfsend.pid have the correct permissions.
| >
| > what's the output of
| >
| > ./nfsen status
| >
| > ./nfsen -A
| >
| > - Peter
| >
| > |
| > | Jon.
| > |
| > |
| > | On 8/16/07, Peter Haag <[EMAIL PROTECTED]> wrote:
| > | >
| > | > -----BEGIN PGP SIGNED MESSAGE-----
| > | > Hash: SHA1
| > | >
| > | >
| > | >
| > | > - --On August 16, 2007 10:11:30 -0400 Jon Spinney <
| > | > [EMAIL PROTECTED]> wrote:
| > | >
| > | > | I am running Fedora 6.
| > | > | I am running PHP version 5.1.6-3.6.fc6
| > | > | I am running Apache 2.2.4
| > | >
| > | > Have you started NfSen with ./nfsen start
| > | > You should see a process nfsend and nfsend-comm, along several nfcapd,
| > one
| > | > for each
| > | > source.
| > | >
| > | > The comm socket is by default in $BASEDIR/var/run/nfsen.comm
| > | >
| > | > PHP looks in conf.php for the path.
| > | >
| > | > - Peter
| > | >
| > | >
| > | > |
| > | > | Thanks for the assistance.
| > | > |
| > | > | Jon
| > | > |
| > | > | On 8/16/07, Peter Haag <[EMAIL PROTECTED]> wrote:
| > | > | >
| > | > | > -----BEGIN PGP SIGNED MESSAGE-----
| > | > | > Hash: SHA1
| > | > | >
| > | > | >
| > | > | >
| > | > | > - --On August 16, 2007 9:32:33 -0400 Jon Spinney <
| > | > | > [EMAIL PROTECTED]> wrote:
| > | > | >
| > | > | > | OK, I have upgraded my nfsen and nfdump to the latest snapshot
| > and
| > | > am
| > | > | > | getting the same error that started this
| > discussion. Unfortunately,
| > | > I
| > | > | > have
| > | > | > | read through this thread several times and am still having
| > | > difficulty.
| > | > | > | (Sorry for being slow). I have verified permissions on
| > nfsen.command
| > | > | > have
| > | > | > | changed it to both my netflow account and the web account with
| > no
| > | > | > luck. I
| > | > | > | am still getting
| > | > | > |
| > | > | > | ERROR: nfsend connect() error: No such file or directory!
| > | > | > | ERROR: nfsend - connection failed!!
| > | > | > | ERROR: Can not initialize globals!
| > | > | >
| > | > | > What OS, PHP apache are you using?
| > | > | >
| > | > | > - Peter
| > | > | > |
| > | > | > | Can someone spell out what is causing my problem and how to
| > resolve
| > | > it.
| > | > | > |
| > | > | > | Thanks for the help.
| > | > | > |
| > | > | > | Jon
| > | > | > |
| > | > | > | On 8/13/07, Peter Haag <[EMAIL PROTECTED]> wrote:
| > | > | > | >
| > | > | > | > -----BEGIN PGP SIGNED MESSAGE-----
| > | > | > | > Hash: SHA1
| > | > | > | >
| > | > | > | >
| > | > | > | >
| > | > | > | > - --On August 13, 2007 8:52:47 +0200 Felix Schueren <
| > | > | > | > [EMAIL PROTECTED]>
| > | > | > | > wrote:
| > | > | > | >
| > | > | > | > | Peter Haag wrote:
| > | > | > | > | >
| > | > | > | > | >
| > | > | > | > | > --On August 13, 2007 8:38:32 +0200 Felix Schueren <
| > | > | > | > [EMAIL PROTECTED]>
| > | > | > | > | > wrote:
| > | > | > | > | >
| > | > | > | > | > | Eric Cables wrote:
| > | > | > | > | > | > I was able to get conf.php installed after fixing my
| > | > | > setlogsock
| > | > | > | > options, but
| > | > | > | > | > | > that doesn't explain the errors I'm getting when
| > accessing
| > | > | > | > nfsen.php.
| > | > | > | > | > | >
| > | > | > | > | > | > ERROR: nfsend connect() error: No such file or
| > directory!
| > | > | > ERROR:
| > | > | > | > nfsend -
| > | > | > | > | > | > connection failed!! ERROR: Can not initialize
| > globals!What
| > | > | > file is
| > | > | > | > it
| > | > | > | > | > | > looking for that it can't find? What connection is
| > | > failing,
| > | > | > | > nfsend is
| > | > | > | > | > | > running.
| > | > | > | > | > | >
| > | > | > | > | > | I'm guessing it is looking for
| > | > | > | > | > | # nfsend communication socket
| > | > | > | > | > | # $COMMSOCKET = "$PIDDIR/nfsen.comm";
| > | > | > | > | > |
| > | > | > | > | > | which means
| > | > | > | > | > | #
| > | > | > | > | > | # directory for all pid files
| > | > | > | > | > | # $PIDDIR="$VARDIR/run";
| > | > | > | > | > |
| > | > | > | > | > | (on a default install), so if you've installed nfsen to
| > | > | > | > | > | /usr/local/nfsen, then it should be
| > | > | > /usr/local/nfsen/run/nfsen.comm,
| > | > | > | > and
| > | > | > | > | > | it probably needs +rw for both the webserver and nfsen
| > UIDs.
| > | > | > | > | >
| > | > | > | > | > No - the webserver has nothing to do with $PIDDIR.
| > | > | > | > | >
| > | > | > | > | on my default install (only changed prefix) my conf.php for
| > the
| > | > web
| > | > | > | > | frontend has:
| > | > | > | > |
| > | > | > | > | [EMAIL PROTECTED]:/var/flows/nfsen/www# cat conf.php
| > | > | > | > | <?
| > | > | > | > | /* This file was automatically created by the NfSen
| > | > install.plscript */
| > | > | > | > |
| > | > | > | > | $COMMSOCKET = "/var/flows/nfsen/var/run/nfsen.comm";
| > | > | > | >
| > | > | > | > That's $COMMSOCKET and not $PIDDIR. The default install puts
| > it
| > | > into
| > | > | > the
| > | > | > | > same
| > | > | > | > directory. So I agree, that $COMMSOCKET needs web server rw
| > | > access,
| > | > | > which
| > | > | > | > is set by
| > | > | > | > nfsend.
| > | > | > | >
| > | > | > | > - Peter
| > | > | > | >
| > | > | > | >
| > | > | > | > |
| > | > | > | > | $DEBUG=0;
| > | > | > | > |
| > | > | > | > | ?>
| > | > | > | > |
| > | > | > | > | [EMAIL PROTECTED]:/var/flows/nfsen/var/run# ls -la
| > | > | > | > | total 12
| > | > | > | > | drwxrwxr-x 2 nfsen www-data 85 2007-08-03 16:45 .
| > | > | > | > | drwxrwxr-x 6 nfsen www-data 50 2007-08-02 09:12 ..
| > | > | > | > | -rw-r--r-- 1 nfsen www-data 6 2007-08-02 13:56
| > | > jc_blue_cgn1.pid
| > | > | > | > | -rw-r--r-- 1 nfsen www-data 6 2007-08-02 13:56
| > | > jcore1_cgn2.pid
| > | > | > | > | srw-rw---- 1 nfsen www-data 0 2007-08-03 15:28 nfsen.comm
| > | > | > | > | -rw-r--r-- 1 nfsen www-data 6 2007-08-03 15:28 nfsend.pid
| > | > | > | > |
| > | > | > | > |
| > | > | > | > | as the nfcapd collector pids have nothing to do with the
| > | > operation
| > | > | > of
| > | > | > | > | the frontend, these don't matter, but the web server will
| > need
| > | > write
| > | > | > | > | access to the pipe nfsen.comm, won't it?
| > | > | > | > |
| > | > | > | > |
| > | > | > | > | regards,
| > | > | > | > |
| > | > | > | > | Felix
| > | > | > | > |
| > | > | > | > |
| > | > | > | > | --
| > | > | > | > | Felix Schueren, Head of NOC
| > | > | > | > |
| > | > | > | > | mailto:[EMAIL PROTECTED]
| > | > | > | > |
| > | > | > | > | Host Europe GmbH - http://www.hosteurope.de
| > | > | > | > | Welserstrasse 14 - D-51149 Koeln - Germany
| > | > | > | > | Telefon (0800) 4678387 - Telefax (01805) 663233
| > | > | > | > | HRB 28495 Amtsgericht Koeln - UST ID DE187370678
| > | > | > | > | Geschaeftsfuehrer U. Braun - M. Read - S. Porter
| > | > | > | > |
| > | > | > | > | Fuer diese Nachricht gilt:
| > | > http://www.hosteurope.de/disclaimer.html
| > | > | > | >
| > | > | > | >
| > | > | > | >
| > | > | > | > - --
| > | > | > | > _______ SWITCH - The Swiss Education and Research Network
| > ______
| > | > | > | > Peter Haag, Security Engineer, Member of SWITCH CERT
| > | > | > | > PGP fingerprint: D9 31 D5 83 03 95 68 BA FB 84 CA 94 AB FC 5D
| > D7
| > | > | > | > SWITCH, Werdstrasse 2, P.O. Box, CH-8021 Zurich,
| > Switzerland
| > | > | > | > E-mail: [EMAIL PROTECTED] Web: http://www.switch.ch/
| > | > | > | > -----BEGIN PGP SIGNATURE-----
| > | > | > | > Version: GnuPG v1.4.3 (Darwin)
| > | > | > | >
| > | > | > | >
| > iQCVAwUBRsANvf5AbZRALNr/AQK4qAQAmXVvkL4h73/qt1EAw4teUeZxM1UDXnW2
| > | > | > | >
| > 322Gwhle0BKY+Jlvf/anEySK48tm0dc/WHY7Zp1LCgoCOi0A5xpLDAOBkaHVQHov
| > | > | > | >
| > p8efzVBLIBdf64z1O+uL6/yaA13fLAWN8d0NY/RfoEicGonxo3Ewy7hpRb2EEVez
| > | > | > | > 4WxBEEgAuOE=
| > | > | > | > =lJPr
| > | > | > | > -----END PGP SIGNATURE-----
| > | > | > | >
| > | > | > | >
| > | > | > | >
| > | > | >
| > | >
| > -------------------------------------------------------------------------
| > | > | > | > This SF.net email is sponsored by: Splunk Inc.
| > | > | > | > Still grepping through log files to find problems? Stop.
| > | > | > | > Now Search log events and configuration files using AJAX and a
| > | > | > browser.
| > | > | > | > Download your FREE copy of Splunk now >>
| > http://get.splunk.com/
| > | > | > | > _______________________________________________
| > | > | > | > Nfsen-discuss mailing list
| > | > | > | > Nfsen-discuss@lists.sourceforge.net
| > | > | > | > https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
| > | > | > | >
| > | > | >
| > | > | >
| > | > | >
| > | > | > - --
| > | > | > _______ SWITCH - The Swiss Education and Research Network ______
| > | > | > Peter Haag, Security Engineer, Member of SWITCH CERT
| > | > | > PGP fingerprint: D9 31 D5 83 03 95 68 BA FB 84 CA 94 AB FC 5D D7
| > | > | > SWITCH, Werdstrasse 2, P.O. Box, CH-8021 Zurich, Switzerland
| > | > | > E-mail: [EMAIL PROTECTED] Web: http://www.switch.ch/
| > | > | > -----BEGIN PGP SIGNATURE-----
| > | > | > Version: GnuPG v1.4.3 (Darwin)
| > | > | >
| > | > | > iQCVAwUBRsRX0/5AbZRALNr/AQIgcQP9G2H3T/FuqV/Xrq/lZNE5DLwC7EratqHX
| > | > | > MwUPMweMrkn6RVqgqh+lXdc71HKodXpAgfiUwc1SC2orpkqrAmQppgd+19dTS2H4
| > | > | > MT9Z8OO4wN57XYoJrHQCCwxAqMtz4k/um+Qw7bXqRVTX+VK4ApzzL9Pifx26wcQ8
| > | > | > PgGf9hRz2hA=
| > | > | > =ZjOU
| > | > | > -----END PGP SIGNATURE-----
| > | > | >
| > | > | >
| > | >
| > | >
| > | >
| > | > - --
| > | > _______ SWITCH - The Swiss Education and Research Network ______
| > | > Peter Haag, Security Engineer, Member of SWITCH CERT
| > | > PGP fingerprint: D9 31 D5 83 03 95 68 BA FB 84 CA 94 AB FC 5D D7
| > | > SWITCH, Werdstrasse 2, P.O. Box, CH-8021 Zurich, Switzerland
| > | > E-mail: [EMAIL PROTECTED] Web: http://www.switch.ch/
| > | > -----BEGIN PGP SIGNATURE-----
| > | > Version: GnuPG v1.4.3 (Darwin)
| > | >
| > | > iQCVAwUBRsRiav5AbZRALNr/AQKJigP+OUYDco8IpC61iq/Wzg4zo44uw+KemKVd
| > | > Hn7JJtVFVY/iLIt7ziJrjvwngkIVfF7hdm+BaWsV+78Jp5d9NzmpF9mO6+5LLH/h
| > | > nlwd5NOlhjUm+MMthCWNpWC3C6B65XeAW0jnsiqRynB5BBsh6hJF+J6AVgHPTDhF
| > | > uy/cd1cfOI8=
| > | > =UcEj
| > | > -----END PGP SIGNATURE-----
| > | >
| > | >
| >
| >
| >
| > - --
| > _______ SWITCH - The Swiss Education and Research Network ______
| > Peter Haag, Security Engineer, Member of SWITCH CERT
| > PGP fingerprint: D9 31 D5 83 03 95 68 BA FB 84 CA 94 AB FC 5D D7
| > SWITCH, Werdstrasse 2, P.O. Box, CH-8021 Zurich, Switzerland
| > E-mail: [EMAIL PROTECTED] Web: http://www.switch.ch/
| > -----BEGIN PGP SIGNATURE-----
| > Version: GnuPG v1.4.3 (Darwin)
| >
| > iQCVAwUBRsRofP5AbZRALNr/AQJuPwP7BZgtwHkyMICVEc89n4Qk3n17vW8upXZt
| > xUtTBtU9ZLkkiAfFPwf8D2+w4B9y2kLHttZE3tSQdF4ZxecmXXAvz2GHtnQXGS9n
| > 935T/3mV1SvzL4ZHtvUx9rNlo020pEb1YUEk8LoLH9HvLNWeLifPs7tdObGVA1Nk
| > KB2GTf0txUU=
| > =fXJL
| > -----END PGP SIGNATURE-----
| >
| >
- --
_______ SWITCH - The Swiss Education and Research Network ______
Peter Haag, Security Engineer, Member of SWITCH CERT
PGP fingerprint: D9 31 D5 83 03 95 68 BA FB 84 CA 94 AB FC 5D D7
SWITCH, Werdstrasse 2, P.O. Box, CH-8021 Zurich, Switzerland
E-mail: [EMAIL PROTECTED] Web: http://www.switch.ch/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (Darwin)
iQCVAwUBRsS20/5AbZRALNr/AQKXtAQAmACID2bPmqt7KqgUxHvZYcyCnul21wvx
eq03xPiNI9yZxt1mYl7xFgRXRk8MxtoUfDMSKeCZDmOpWE60tthH1CFFeULHAVhn
JJw73ZHG8BQDJB0tLw1YAYAKCZm0LwycQLX5OGY6jh6CSfjIRfqGqcr09ocQHE0z
cylI7WDtZXE=
=IpN9
-----END PGP SIGNATURE-----
-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
Nfsen-discuss mailing list
Nfsen-discuss@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
