Hello Peter, > Make sure your rrd library and Perl module for RRD are linked correctly, > as well as the loader will find them.
The live profile works fine. The graphs looks good. I am not use empy filters for subprofile. I use like 'proto udp' or 'as ASnum' Now i set filter 'any' and type 1:1, but results the same. I am not use nfcad. I use flow-capture, and pile up data in folder for profile 'live' after converting data by the utility ft2nfdump . The data processing occurs before the nfsen process is run. I repeat again -- the profile 'live' works fine. Maybe I am not understand correctly how must works a sub-profile. I think the nfprofile process apply filter for file which was stored in folder for profile 'live' and after that it is copying result file in to sub-profile directory. Is it right? 29.07.2012 13:27, Peter Haag пишет: > Make sure your rrd library and Perl module for RRD are linked correctly, > as well as the loader will find them. > for a 1:1 profile use filer 'any' an empty filter means 'not any' > > - Peter > > > On 23/7/12 1:19 PM, Anrey Teslenko wrote: >> Hello all, >> >> Let me to raise this issue once again. I've seen a lot of >> correspondences on this topic but has not found the answer to resolve >> it >> >> My nfdump: Version: 1.6.6 $Date: 2012-03-11 11:57:45 +0100 (Sun, 11 Mar 2012) >> My nfsen: Version: 1.3.6p1 $Id: nfsen 53 2012-01-23 16:36:02Z peter >> >> I have a problem when nftsen trying to collect the data from "live" profile >> into >> other new profile. All nfcapd files for all profiles are empty with a >> size of 312 bytes. >> >> >> This is a output of nfdump for this files. >> >> Date flow start Duration Proto Src IP Addr:Port >> Dst IP Addr:Port Packets Bytes Flows >> Summary: total flows: 0, total bytes: 0, total packets: 0, avg bps: 0, >> avg pps: 0, avg bpp: 0 >> Time window: <unknown> >> Total flows processed: 0, Blocks skipped: 0, Bytes read: 36 >> Sys: 0.000s flows/second: 0.0 Wall: 0.000s flows/second: 0.0 >> >> I see zeros in rrd file. >> For appropriate file in profile live all looks good . >> I see next in log file >> >> Run periodic at Mon Jul 23 13:40:00 2012 >> Prepare profiling './FlowStatistics' >> Prepare profiling './live' >> 1 channels/alerts to profile >> nfprofile run: /usr/local/bin/nfprofile -I -t 1343039700 -p >> /home/netflow/flows -P /var/www/nfsen/profiles-stat -L local3 -M >> /home/netflow/flows/live/upstreams -r nfcapd.201207231335 >> Limit profilers: 1 >> profile opts: .#FlowStatistics#2#AS6703#upstreams for profiler 0 >> profiler 0 started >> comm child[16690] terminated with no exit value >> Process line '.#FlowStatistics#2#AS6703#upstreams#012' >> Setup channel 'AS6703' in profile 'FlowStatistics' group '.', >> channellist 'upstreams' >> profiler 0 finished >> Update profile FlowStatistics in group . >> Add channel size 20480 >> Set new profile size: 20480 >> Add .:FlowStatistics:201207231335 for plugin processing >> >> >> When i trying to start from command line >> /usr/local/bin/nfprofile -I -t 1343041440 -p /home/netflow/flows -P >> /var/www/php-cisco/profiles-stat -L local3 -M >> /home/netflow/flows/live/upstreams -r nfcapd.201207231402 >> >> Process just sleep and do nothing (may be hung) >> >> www-data 22884 0.0 0.1 9312 1648 pts/1 S+ 14:06 0:00 >> /usr/local/bin/nfprofile -I -t 1343039700 -p /home/netflow/flows -P >> /var/www/php-cisco/profiles-stat -L local3 -M >> /home/netflow/flows/live/upstreams -r nfcapd.201207231335 >> >> I see next in syslog when i try push ENTER >> >> Jul 23 14:10:16 nettools nfprofile[22884]: Process line '#012' >> Jul 23 14:10:16 nettools nfprofile[22884]: Incomplete line - channel skipped. >> Jul 23 14:10:16 nettools nfprofile[22884]: Process line '#012' >> Jul 23 14:10:16 nettools nfprofile[22884]: Incomplete line - channel skipped. >> Jul 23 14:10:16 nettools nfprofile[22884]: Process line '#012' >> Jul 23 14:10:16 nettools nfprofile[22884]: Incomplete line - channel skipped. >> >> ------------------------------------------------------------------------------ >> Live Security Virtual Conference >> Exclusive live event will cover all the ways today's security and >> threat landscape has changed and how IT managers can respond. Discussions >> will include endpoint security, mobile security and the latest in malware >> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/ >> _______________________________________________ >> Nfsen-discuss mailing list >> Nfsen-discuss@lists.sourceforge.net >> https://lists.sourceforge.net/lists/listinfo/nfsen-discuss >> ------------------------------------------------------------------------------ Live Security Virtual Conference Exclusive live event will cover all the ways today's security and threat landscape has changed and how IT managers can respond. Discussions will include endpoint security, mobile security and the latest in malware threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/ _______________________________________________ Nfsen-discuss mailing list Nfsen-discuss@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
