OK, it actually is expiring the data. I am wondering if the methodolgy for expiration changed in recent versions. Seems to me that previously, it was deleting data in a 1 for 1 fashion before. i.e. every 5 minutes the oldest entry 30 days ago would go away. Now it seems that based on the tstart time(I know this because I saw the change on the disk monitoring at that time), it will delete all data older than 30 days all at once. Did that make sense? I am really just trying to figure out what to expect now that I have upgraded.
Here's the profile info today. It expired 8GB. The tstart changed from Feb 11 to Feb 14 overnight....something is missing here, it jumped 3 days overnight were I would have expected to see Feb 12 as the new tstart. name live group (nogroup) tcreate Tue Mar 27 16:20:00 2007 tstart Thu Feb 14 10:10:00 2008 tend Wed Mar 12 15:55:00 2008 updated Wed Mar 12 15:55:00 2008 expire 30 days 0 hours size 60.2 GB maxsize 0 type live locked 0 status OK version 130 Thanks. Chris Waters Technology Services - Network Group JELD-WEN, Inc. Information Systems [EMAIL PROTECTED] -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Chris Waters Sent: Wednesday, March 12, 2008 9:06 AM To: Peter Haag; [email protected] Subject: Re: [Nfsen-discuss] Profile Data Not Expiring Actually I didn't recompress the old ones by hand. I decided to let them naturally expire which means in a month they will all be compressed. I will keep an eye on this. Thanks Peter. -----Original Message----- From: Peter Haag [mailto:[EMAIL PROTECTED] Sent: Wednesday, March 12, 2008 8:58 AM To: Chris Waters; [email protected] Subject: Re: [Nfsen-discuss] Profile Data Not Expiring -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --On March 12, 2008 8:46:44 -0700 Chris Waters <[EMAIL PROTECTED]> wrote: | Here is the output with just the first few lines of channels: | | # /usr/local/svn/nfsen/bin/nfsen -l live | name live | group (nogroup) | tcreate Tue Mar 27 16:20:00 2007 | tstart Mon Feb 11 11:10:00 2008 | tend Wed Mar 12 08:30:00 2008 | updated Wed Mar 12 08:30:00 2008 | expire 30 days 0 hours | size 68.6 GB | maxsize 0 | type live | locked 0 | status OK | version 130 | channel vca-gan-wd-1 sign: + colour: #009933 order: 1 | sourcelist: vca-gan-wd-1 Files: 8532 Size: 43110400 | channel vca-ott-wd-1 sign: + colour: #009933 order: 2 | sourcelist: vca-ott-wd-1 Files: 8533 Size: 37076992 | channel vca-sap-wd-1 sign: + colour: #009933 order: 3 | sourcelist: vca-sap-wd-1 Files: 8532 Size: 911118336 | | Isn't the tstart value supposed to change at every expire? I believe | it has remained the same since I turned on compression. Well - it changes only, if there are files to expire. Feb 11 to Mar 12 is pretty much 30days. So it seams reasonable to me. NfSen swings within the watermarks, but expires only, when lifetime or size exceeds the given limit. So it is pretty normal, that NfSen does not expire as long as the limits are not reached. Please not: If you compressed older files by hand/shell script you must rebuild the profile, otherwise NfSen does not know, that you manipulated the files by hand. Run ./nfsen -r live - Peter | | Thanks for the help. | | Chris Waters | Technology Services - Network Group | JELD-WEN, Inc. | Information Systems | [EMAIL PROTECTED] | | -----Original Message----- | From: Peter Haag [mailto:[EMAIL PROTECTED] | Sent: Wednesday, March 12, 2008 5:25 AM | To: Chris Waters; [email protected] | Subject: Re: [Nfsen-discuss] Profile Data Not Expiring | | -----BEGIN PGP SIGNED MESSAGE----- | Hash: SHA1 | | | | - --On March 11, 2008 17:18:05 -0700 Chris Waters | <[EMAIL PROTECTED]> | wrote: | | | Quickstats: | | nfsen from svn version 24 | | nfdump 1.5.7 | | Centos 5.1 x86_64 | | | | After my recent upgrade, it appears that the expiry is not working | | for | | | my live profile. If I look through the logs, I see an odd entry for | | the low water mark, note the | | "%%": | | | | [EMAIL PROTECTED] etc]# tail -f /var/log/messages | grep nfsen Mar 11 | | 17:05:16 netflow nfsen[21837]: 3 channels/alerts to profile Mar 11 | | 17:05:16 netflow nfsen[21837]: Update profile live in group . | | Mar 11 17:05:27 netflow nfsen[21837]: Update profile VPN in group | | VPN Mar 11 17:05:27 netflow nfsen[21837]: Run expire at Tue Mar 11 | | 17:05:00 | | 2008 | | Mar 11 17:05:27 netflow nfsen[21837]: Expire profile live group . | | low water mark: 90%% Mar 11 17:05:35 netflow nfsen[21837]: End | | expire at Tue Mar 11 17:05:00 | | 2008 | | | | The stats for the profile show that the start time is not changing. | | | | Any quick tips on where to look to see what's going on? | | Well - according the log, there is nothing to expire. | you check on the command line: ./nfsen -l live | | | You see the profile stats including its limits. | | What does it say? | | - Peter | | | | | Thanks. | | | | | | Chris Waters | | | | Technology Services - Networks Group | | | | | | | | JELD-WEN, inc. | | | | Information Systems | | | | [EMAIL PROTECTED] | | | | RELIABILITY for real life(r) | | | | This correspondence is for the named person's use only. It may | | contain | | | confidential or legally privileged information and is intended | | solely for the named addressee. If you receive this correspondence | | in error, please notify the sender and delete it from your system. | | You must not disclose, copy or rely on any part of this | | correspondence if you are not the intended recipient. | | | | | | | | - -- | _______ SWITCH - The Swiss Education and Research Network ______ Peter | Haag, Security Engineer, Member of SWITCH CERT PGP fingerprint: D9 | 31 | D5 83 03 95 68 BA FB 84 CA 94 AB FC 5D D7 | SWITCH, Werdstrasse 2, P.O. Box, CH-8021 Zurich, Switzerland | E-mail: [EMAIL PROTECTED] Web: http://www.switch.ch/ -----BEGIN PGP | SIGNATURE----- | Version: GnuPG v1.4.3 (Darwin) | | iQCVAwUBR9fLof5AbZRALNr/AQL40AQAl/jJglhbBfgr0MFs4P7QEq6ZnXg+3dj8 | SWotp7zHGkDAiPahS6aludC5Inn8OPULM5goStVEgbFHpSlKGg0sbBRrzO5XFUIt | /Fa/GY8GqoKdHWf5JSV2JI6yugDYeSnxVdiXE3FO37xzDUsihuzSokMq0zxS9k1W | m+pQy8QhpEQ= | =qoIN | -----END PGP SIGNATURE----- | | | ---------------------------------------------------------------------- | --- This SF.net email is sponsored by: Microsoft Defy all challenges. | Microsoft(R) Visual Studio 2008. | http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/ | _______________________________________________ | Nfsen-discuss mailing list | [email protected] | https://lists.sourceforge.net/lists/listinfo/nfsen-discuss - -- _______ SWITCH - The Swiss Education and Research Network ______ Peter Haag, Security Engineer, Member of SWITCH CERT PGP fingerprint: D9 31 D5 83 03 95 68 BA FB 84 CA 94 AB FC 5D D7 SWITCH, Werdstrasse 2, P.O. Box, CH-8021 Zurich, Switzerland E-mail: [EMAIL PROTECTED] Web: http://www.switch.ch/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.3 (Darwin) iQCVAwUBR9f9l/5AbZRALNr/AQKYqgP+Pogs8mdeI+8qxpoE6QsnCBfNOJcHA/uk LOwxu+58CEF9QIO6AYGQt3atkU/dSbAbOO0BME0ruHqxyUFLNnCIqbFYMNOdD9+k CF75OoSh8/UTsbLW8VQbReEWESj8b3JwZudlxD452oiSiY1w/V2VN9wKHuE5w09h 8MPz+FhDbRo= =0WBN -----END PGP SIGNATURE----- ------------------------------------------------------------------------ - This SF.net email is sponsored by: Microsoft Defy all challenges. Microsoft(R) Visual Studio 2008. http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/ _______________________________________________ Nfsen-discuss mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/nfsen-discuss ------------------------------------------------------------------------- This SF.net email is sponsored by: Microsoft Defy all challenges. Microsoft(R) Visual Studio 2008. http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/ _______________________________________________ Nfsen-discuss mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
