Hi Peter, thank you for the answer. Nevertheless it seems that it is what happened. I will perform another test today to validate/invalidate what I saw. From you explanation, what I understand - at least when a size limit is defined - is that: - When size limit is reached all the oldest ?data? files managed by profile will be deleted until Max Size - (Max Size * watermark) is reached - Capture Nfcapd processes associated with profile continues to run and populate data directory - Profile continues to process new inputs from Nfcapd
I will come back later with my test results. Best regards Pierre Peter Haag wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Hi Pierre, > There are a few things to note: > > Up to and including nfsen-1.3 profiles expire independently regardless of the > fill size of the file system. > This means you have to take care that the file system does not get > overcrowded. > > Each profile has 2 parameters to play: size and lifetime. Profiles are > expired when ever one of the limits are reached. > Expiring is down to limit * watermark. An appropriate watermake could be 95% > for example. Say you have set a size limit > of 100M and your profile is larger than that, in will expire down to 95M > during the next expire cycle. This also means > do not set you watermark too low, or your files will get fully > deleted.However, the data-directory never gets deleted > anyway. > > - Peter > > Pierre de La Motte wrote: > >> Hi, >> first thank you very much for the NFSen tool suit, it is a great piece >> of monitoring solution. >> I am currently trying to solve the same "issue" Ewald was addressing in >> his December email, meaning keeping my disk usage within fixed boundaries. >> My requirement: to have a process pruning the oldest Nfcapd capture >> files in profile data without impacting my "live" profile, and depending >> profiles, stats. The pruning would of course limit the ability to go >> back in the past to draw detailed report to the still existing nfcapd >> files. But the profile would continue to provide graphing and reporting >> on the current data and would keep a graph history of the report >> filters associated with channels >> Reading the help in stats, I was not so sure of the meaning of >> "expiring", basically whether it was meaning what is described above >> (pruning capability) or if it was meaning that the profile would turn >> into a history profile. >> Based on the answers to Ewald, I deduced that the answer would be the >> first alternative. >> To test that I defined a Max Size in my "live" channel and waited for >> the result. >> The result has been that when the defined limit was reached, my >> profiles-data directory, and sub-directories, was no more existing. >> Everything was gone, including the directory structure and the root >> directory. My live profile was no more processing live data. >> On the other hand, the stat directory, and all dependencies, was still >> there. >> It seems that I missed a point somewhere. >> How should I proceed to implement the pruning scheme defined above? >> How can I reactivate my current live profile? (I changed back the max >> size to 0 and tried "nfsen reconfig" without success - It seems that I >> need to stop nfsen, recreate manually the directory tree to allow Nfsen >> to correctly invoke nfcapd then restart nfsen) >> >> Best regards >> Pierre >> >> ------------------------------------------------------------------------------ >> This SF.net email is sponsored by: >> SourcForge Community >> SourceForge wants to tell your story. >> http://p.sf.net/sfu/sf-spreadtheword >> _______________________________________________ >> Nfsen-discuss mailing list >> Nfsen-discuss@lists.sourceforge.net >> https://lists.sourceforge.net/lists/listinfo/nfsen-discuss >> > > - -- > _______ SWITCH - The Swiss Education and Research Network ______ > Peter Haag, Security Engineer, Member of SWITCH CERT > PGP fingerprint: D9 31 D5 83 03 95 68 BA FB 84 CA 94 AB FC 5D D7 > SWITCH, Werdstrasse 2, P.O. Box, CH-8021 Zurich, Switzerland > E-mail: peter.h...@switch.ch Web: http://www.switch.ch/ > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.4.5 (Darwin) > > iQCVAwUBSXQm6v5AbZRALNr/AQLk3AP+PSrMkIucOr2vb3C3KAFZLTino6AqyXYV > 66semN1IL3B3mteeeiB92XoQYAGrEccDbqey9CgEJ7pXIHNQmIb6kL40jKi8FjnY > AYpGGwZDtSnBhuddTbVkBEu7MIa/VsaqP/QtXmdcKgTYFiyB41CET+5QPetLGgso > xH1ANIgp6vE= > =uiQJ > -----END PGP SIGNATURE----- > > ------------------------------------------------------------------------------ This SF.net email is sponsored by: SourcForge Community SourceForge wants to tell your story. http://p.sf.net/sfu/sf-spreadtheword _______________________________________________ Nfsen-discuss mailing list Nfsen-discuss@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
