I've solved reloading sfcapd every 5 minutes, not a clean solution but works:
Crontab:
0,5,10,15,20,25,30,35,40,45,50,55 * * * * /root/restart_sfcapd.sh
restart_sfcapd.sh:
#!/bin/bash
/bin/ps ax | grep "sfcapd" | grep nfsen | awk '{print $1}' | xargs -i kill {}
sleep 2
`/usr/local/bin/sfcapd -w -D -p 6343 -u nfsen -g www-data -B 200000 -S
1 -P /nfsen/var/run/p6343.pid -z -T all -I firewall -l
/nfsen/profiles-data/live/firewall`
Bye
Mirko
2011/3/14 Mirko Maffioli <mirkomaffi...@gmail.com>:
> Hi,
>
> I'm trying to use nfsen to display sflow.
> Everything works fine but when i try to do some search with netflow
> processing via web browser i get this error:
>
> ** nfdump -M /var/nfsen/profiles-data/live/firewall -T -r
> 2011/03/14/nfcapd.201103141155 -a -A srcip -c 20
> nfdump filter:
> any
> Corrupt data file. Missing extension map 0. Skip record.
>
> After i enable the $EXTENSIONS = 'all'; option in nfsen.conf the
> processing works and i see this output:
>
> [root@local]# nfdump -x nfcapd.201103141150
>
> Dump all extension maps:
> ========================
> Extension Map:
> Map ID = 0
> Map Size = 28
> Ext Size = 52
> Index 1, ext 5 = 4 byte input/output interface index
> Index 2, ext 7 = 4 byte src/dst AS number
> Index 3, ext 8 = dst tos, direction, src/dst mask
> Index 6, ext 13 = src/dst vlan id
> Index 10, ext 20 = in src/out dst mac address
> Index 4, ext 9 = IPv4 next hop
> Index 5, ext 11 = IPv4 BGP next IP
> Index 13, ext 23 = IPv4 router IP addr
>
> The problem is after 5 minutes, when the nfsen cycle file. It seems
> that the extension option is disabled:
>
> [root@local]# nfdump -x nfcapd.201103141155
>
> Dump all extension maps:
> ========================
> [root@local]#
>
>
> I'm using nfsen 1.3.5, nfdump 1.6.3 and PortTracker plugin
>
> --
> Saluti
> Mirko
>
--
Saluti
Mirko
------------------------------------------------------------------------------
Colocation vs. Managed Hosting
A question and answer guide to determining the best fit
for your organization - today and in the future.
http://p.sf.net/sfu/internap-sfd2d
_______________________________________________
Nfsen-discuss mailing list
Nfsen-discuss@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
