Hello Steve,
I have developed a plugin that does just that - but I haven't released it
yet. I'm hoping to tie some bugs and release it later this year
On Tue, Sep 9, 2008 at 5:36 PM, Steve Foley <[EMAIL PROTECTED]> wrote:
> Greetings from a new user. My apologies if this has already been
> addressed, but I didnt see anything in the archives and have been
> struggling to get things working right (and Im so close!). It looks
> like nfsen will do exactly what I want if only I can work this this
> problem that I am having:
>
> Im running nfsen 1.3 on a Solaris 10 box. After a little bit of
> futzing to get it going (seems the conf.php file still starts with
> "<?" and not "<?php", BTW), everything seems to be working reasonably
> well with just the live profile. When I create any other profile that
> I have tried, the graphs stop updating and the "End" time in the
> "Profileinfo" freezes where it is until I remove the profile I
> created. The profile I create never gets anything to show on a graph
> and has the same start and end time in its "Profileinfo" listing.
> Reloading "live" seems to update the start and end times (but not the
> graphs of course), but the end time never increases beyond that until
> the new profile is removed. Throughout this time, nfcapd seems to keep
> working and adding to data files on the disk. Logs seem to be fairly
> normal with the exception being this exchange showing up with the
> added profile exists:
>
> Sep 8 23:40:15 anfmon <13>Sep 8 23:40:15 nfsen[5319]: Run periodic
> at Mon Sep 8 23:40:00 2008
> Sep 8 23:40:15 anfmon <13>Sep 8 23:40:15 nfsen[5319]: Prepare
> profiling './live'
> Sep 8 23:40:15 anfmon <13>Sep 8 23:40:15 nfsen[5319]: Prepare
> profiling 'HiSeasNet/SatMex5b2'
> Sep 8 23:40:15 anfmon <12>Sep 8 23:40:15 nfsen[5319]: 2 channels/
> alerts to profile
> Sep 8 23:40:15 anfmon <13>Sep 8 23:40:15 nfsen[5319]: profile opts:
> HiSeasNet#SatMex5b2#2#WaltonSmithOut#kuband
> Sep 8 23:40:15 anfmon <13>Sep 8 23:40:15 nfsen[5319]: profile opts:
> HiSeasNet#SatMex5b2#2#EndeavorOut#kuband
> Sep 8 23:40:15 anfmon <13>Sep 8 23:40:15 nfsen[5319]: nfsend: exit
> child[18392] Exit: 0, Signal: 9, Core: 0
> Sep 8 23:40:15 anfmon <9>Sep 8 23:40:15 nfsen[5319]: nfprofile failed:
> Sep 8 23:40:15 anfmon <13>Sep 8 23:40:15 nfsen[5319]: System was: /
> opt/netflow/bin/nfprofile -I -t 1220916900 -p /opt/netflow/profiles-
> data -P /opt/netflow/profiles-stat -S 5 -M /opt/netflow/profiles-data/
> live/kuband -r nfcapd.200809082335
>
> Normally (with no profile) it looks something like:
> Sep 5 04:30:15 anfmon <13>Sep 5 04:30:15 nfsen[25768]: Run periodic
> at Fri Sep 5 04:30:00 2008
> Sep 5 04:30:15 anfmon <13>Sep 5 04:30:15 nfsen[25768]: Prepare
> profiling './live'
> Sep 5 04:30:15 anfmon <12>Sep 5 04:30:15 nfsen[25768]: 0 channels/
> alerts to profile
> Sep 5 04:30:15 anfmon <13>Sep 5 04:30:15 nfsen[25768]: No continous
> profiles - nothing to profile
> Sep 5 04:30:15 anfmon <12>Sep 5 04:30:15 nfsen[25768]: Update
> profile live in group .
> Sep 5 04:30:15 anfmon <13>Sep 5 04:30:15 nfsen[25768]: Add channel
> size 62583808
> Sep 5 04:30:15 anfmon <13>Sep 5 04:30:15 nfsen[25768]: Set new
> profile size: 62583808
> Sep 5 04:30:15 anfmon <13>Sep 5 04:30:15 nfsen[25768]: Add .:live:
> 200809050425 for plugin processing
>
>
> I saw a post about filters causing similar problems, but the channel
> filters (no filtering on the profile) I have tried are pretty straight
> forward and accepted by both nfdump on the command line, as well as
> nfsen in the Netflow Processing form. Specifically I have tried
> filters of "IN IF 4" and "( DST NET 131.128/16 ) and ( ( OUT IF 14 )
> or ( OUT IF 23 ) )". I have also tried both real and shadow profiles
> that are continuous.
>
> Ultimately I am trying to graph individual network usage and top
> talkers across a couple of router interfaces that handles traffic to
> 5-10 networks in near real-time (5 min delay is okay, but Id rather
> have 1-2 min delay). Id love to see which network destinations are
> using what portion of the link. If there is a better way than
> filtering channels in a profile, Id love to hear it.
>
> Thanks for any suggestions,
> -Steve
>
> -----
> Steve Foley
> Scripps Institution of Oceanography
> [EMAIL PROTECTED], (858) 822-3356
>
>
>
> -------------------------------------------------------------------------
> This SF.Net email is sponsored by the Moblin Your Move Developer's
> challenge
> Build the coolest Linux based applications with Moblin SDK & win great
> prizes
> Grand prize is a trip for two to an Open Source event anywhere in the world
> http://moblin-contest.org/redirect.php?banner_id=100&url=/
> _______________________________________________
> Nfsen-discuss mailing list
> Nfsen-discuss@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
>
-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
Nfsen-discuss mailing list
Nfsen-discuss@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
