Hi Peter, thx for the help. After testing and checking syslog and other messages/dmesg I discovered that I had a hardware failure almost exactly at the time (in mn) at which the profile expired. As a result, and due to a misconfiguration, the disk on whuch profiles-data sit was not mounted back. Hence the disappearance. Could you precise your comment "independently regardless of the fill size of the file system"? I understand it as expire process is only driven by the parameters defined in the profile, there no actual double check of the value of these parameters wrt the actual space available (at set up or during the life of the profile) . Which is fine with me. Best regards Pierre Peter Haag wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Hi Pierre, > There are a few things to note: > > Up to and including nfsen-1.3 profiles expire independently regardless of the > fill size of the file system. > This means you have to take care that the file system does not get > overcrowded. > > Each profile has 2 parameters to play: size and lifetime. Profiles are > expired when ever one of the limits are reached. > Expiring is down to limit * watermark. An appropriate watermake could be 95% > for example. Say you have set a size limit > of 100M and your profile is larger than that, in will expire down to 95M > during the next expire cycle. This also means > do not set you watermark too low, or your files will get fully > deleted.However, the data-directory never gets deleted > anyway. > > - Peter > > Pierre de La Motte wrote: > >> Hi, >> first thank you very much for the NFSen tool suit, it is a great piece >> of monitoring solution. >> I am currently trying to solve the same "issue" Ewald was addressing in >> his December email, meaning keeping my disk usage within fixed boundaries. >> My requirement: to have a process pruning the oldest Nfcapd capture >> files in profile data without impacting my "live" profile, and depending >> profiles, stats. The pruning would of course limit the ability to go >> back in the past to draw detailed report to the still existing nfcapd >> files. But the profile would continue to provide graphing and reporting >> on the current data and would keep a graph history of the report >> filters associated with channels >> Reading the help in stats, I was not so sure of the meaning of >> "expiring", basically whether it was meaning what is described above >> (pruning capability) or if it was meaning that the profile would turn >> into a history profile. >> Based on the answers to Ewald, I deduced that the answer would be the >> first alternative. >> To test that I defined a Max Size in my "live" channel and waited for >> the result. >> The result has been that when the defined limit was reached, my >> profiles-data directory, and sub-directories, was no more existing. >> Everything was gone, including the directory structure and the root >> directory. My live profile was no more processing live data. >> On the other hand, the stat directory, and all dependencies, was still >> there. >> It seems that I missed a point somewhere. >> How should I proceed to implement the pruning scheme defined above? >> How can I reactivate my current live profile? (I changed back the max >> size to 0 and tried "nfsen reconfig" without success - It seems that I >> need to stop nfsen, recreate manually the directory tree to allow Nfsen >> to correctly invoke nfcapd then restart nfsen) >> >> Best regards >> Pierre >> >> ------------------------------------------------------------------------------ >> This SF.net email is sponsored by: >> SourcForge Community >> SourceForge wants to tell your story. >> http://p.sf.net/sfu/sf-spreadtheword >> _______________________________________________ >> Nfsen-discuss mailing list >> Nfsen-discuss@lists.sourceforge.net >> https://lists.sourceforge.net/lists/listinfo/nfsen-discuss >> > > - -- > _______ SWITCH - The Swiss Education and Research Network ______ > Peter Haag, Security Engineer, Member of SWITCH CERT > PGP fingerprint: D9 31 D5 83 03 95 68 BA FB 84 CA 94 AB FC 5D D7 > SWITCH, Werdstrasse 2, P.O. Box, CH-8021 Zurich, Switzerland > E-mail: peter.h...@switch.ch Web: http://www.switch.ch/ > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.4.5 (Darwin) > > iQCVAwUBSXQm6v5AbZRALNr/AQLk3AP+PSrMkIucOr2vb3C3KAFZLTino6AqyXYV > 66semN1IL3B3mteeeiB92XoQYAGrEccDbqey9CgEJ7pXIHNQmIb6kL40jKi8FjnY > AYpGGwZDtSnBhuddTbVkBEu7MIa/VsaqP/QtXmdcKgTYFiyB41CET+5QPetLGgso > xH1ANIgp6vE= > =uiQJ > -----END PGP SIGNATURE----- > >
------------------------------------------------------------------------------ This SF.net email is sponsored by: SourcForge Community SourceForge wants to tell your story. http://p.sf.net/sfu/sf-spreadtheword _______________________________________________ Nfsen-discuss mailing list Nfsen-discuss@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
