Hi,
I ran into the same problem trying to mix sflow and netflow sources. Running
nfsen 1.3.5 and nfdump 1.6.2.
I saw your posting on the list but no reply. I investigated myself. I think I
fix it, so I'm sharing. I fixed by modifying the file libexec/NfSenRC.pm. There
was a closing bracket on line 64 that I think was misplaced and should have
been on line 73.
Here is how it was originally (starting at line 60):
foreach my $source ( sort keys %NfConf::sources ) {
my $_port = $NfConf::sources{$source}{'port'};
if ( $_port == $port ) {
push @SourceList, $source;
}
my $_type = exists $NfConf::sources{$source}{'type'} ?
$NfConf::sources{$source}{'type'}: 'netflow';
if ( defined $type ) {
if ( $type ne $_type ) {
print "Can not start different type '$type' and
'$_type' on same port!\n";
return;
}
} else {
$type = $_type;
}
}
And here is how I move the bracket:
foreach my $source ( sort keys %NfConf::sources ) {
my $_port = $NfConf::sources{$source}{'port'};
if ( $_port == $port ) {
push @SourceList, $source;
my $_type = exists $NfConf::sources{$source}{'type'} ?
$NfConf::sources{$source}{'type'}: 'netflow';
if ( defined $type ) {
if ( $type ne $_type ) {
print "Can not start different type '$type' and
'$_type' on same port!\n";
return;
}
} else {
$type = $_type;
}
}
}
After that it worked fine. I can capture sflow sources and netflow sources now
(each in different ports). I am also able to have multiples sflow source on the
same port. So the above change does not break that functionality (which I think
this foreach is for).
Additional note: Although I think the change above is appropriate I should say
that I haven't been able to trigger the error message after the change. If I
specify two sources on the same port, one with netflow and another with sflow
the error gets caught before reaching this part of the code (I think when
NfSources is parsed before calling the StartCollector routine). Also, I should
point out it is the first time I'm looking at the code (just installed nfsen
and ran into the problem) so these are the first impressions of a nfsen newbie.
G.
Guillermo Vargas-Dellacasa
Computer Operations Manager
North Hunterdon-Voorhees Regional High School District
(908) 713-4162
gvargas-dellac...@nhvweb.net
With an older version of nfsen (1.3) I was able to mix netflow and sflow
sources with this config:
%sources = (
'sv3-edge-1' => { 'port' => '6669', 'col' => '#000033', 'type' =>
'sflow' },
'sv3-edge-2' => { 'port' => '6670', 'col' => '#6600CC', 'type' =>
'sflow' },
'sv3-peer-1' => { 'port' => '6671', 'col' => '#FFFF00', 'type' =>
'sflow' },
'dc4-peer-1' => { 'port' => '6672', 'col' => '#CC6600', 'type' =>
'sflow' },
'dc4-edge-1' => { 'port' => '6673', 'col' => '#0066CC', 'type' =>
'netflow'},
'dc4-edge-2' => { 'port' => '6674', 'col' => '#006600', 'type' =>
'netflow'},
);
since upgrading to 1.3.5 however (and nfdump 1.6), nfsen won't start the
collectors with this error:
Can not start different type 'netflow' and 'sflow' on same port!
Can not start different type 'netflow' and 'sflow' on same port!
Can not start different type 'netflow' and 'sflow' on same port!
Can not start different type 'netflow' and 'sflow' on same port!
Can not start different type 'netflow' and 'sflow' on same port!
Can not start different type 'netflow' and 'sflow' on same port!
If I move the type to sflow for everything or netflow for everything, it
seems to start, though, naturally, it won't work since some of my sources
are sflow, some are netflow. Any ideas?
-James
--
James Kelty
Lead Network Engineer
"Clams are eeeeeeeeevil...."
- Maisie K. Age 3
------------------------------------------------------------------------------
Special Offer-- Download ArcSight Logger for FREE (a $49 USD value)!
Finally, a world-class log management solution at an even better price-free!
Download using promo code Free_Logger_4_Dev2Dev. Offer expires
February 28th, so secure your free ArcSight Logger TODAY!
http://p.sf.net/sfu/arcsight-sfd2d
_______________________________________________
Nfsen-discuss mailing list
Nfsen-discuss@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
