If you have sticky hosts enabled, and hosts are aging out, something is broken for sure. You'll want to submit an "official" bug report. I have hosts in ntop since the last start over 90 days ago.
Long term data retention (detailed data) has always been an issue. I think because ntop was originally designed to be lightweight and grew from there. In the case you mentioned, sometimes hosts don't accept http connects directly - which may be why you receive that error. I run into this often and itsd annoying. These are typically large hosting companies who's servers accept connections via url redirects, so unless you know the correct url you get the 404. You can search ntop for the host in question, if its there the sticky part is working. From: Abel, Jacob [mailto:[email protected]] Sent: Thursday, May 26, 2011 12:38 PM To: [email protected] <[email protected]> Subject: Re: [Ntop] [NTop]: NTop General Configuration Thanks Gary, Just the persistence of data as mentioned before. I’ve got it running with sticky hosts and have also disabled instant session purging. I’ve got it storing session data out to MySQL, but as far as Ntop itself goes, hosts/IPs are still disappearing rather frequently. I did look at the round robin database as you suggested and everything is set in there to keep data for months it seems. Of particular interest is Ntop showing that a certain person recently connected to a certain IP, and upon clicking that IP, it says that Ntop has no information on it, basically a 404 page. Thanks for all your help. Jacob Abel ms consultants, inc.<http://www.msconsultants.com/> engineers, architects, planners 2221 Schrock Road Columbus, Ohio 43229-1547 p 614-898-7100 Ext. 163 f 614-898-7570 [email protected]<mailto:[email protected]> Notice of Confidentiality: **This e-mail and any of its attachments may contain proprietary information, which is privileged, confidential, or subject to copyright belonging to ms consultants, inc. This e-mail is intended solely for the use of the individual or entity to which it is addressed. If you are not the intended recipient of this e-mail, you are hereby notified that any dissemination, distribution, copying, or action taken in relation to the contents of and/or attachments to this e-mail is strictly prohibited and may be unlawful. If you have received this e-mail in error, please notify the sender immediately and permanently delete the original and any copy of this e-mail and any printout.** From: [email protected] [mailto:[email protected]] On Behalf Of Gary Gatten Sent: Thursday, May 26, 2011 1:27 PM To: '[email protected]' Subject: Re: [Ntop] [NTop]: NTop General Configuration If you have any specific use cases you're struggling with let me know and I'll try to help. From: Abel, Jacob [mailto:[email protected]] Sent: Thursday, May 26, 2011 10:30 AM To: [email protected] <[email protected]> Subject: Re: [Ntop] [NTop]: NTop General Configuration I was just being formal, didn’t mean to imply age. I have read the manpage and the less than helpful information on the ntop website, and found it to be inadequate. From: [email protected] [mailto:[email protected]] On Behalf Of Gary Gatten Sent: Thursday, May 26, 2011 10:08 AM To: '[email protected]' Subject: Re: [Ntop] [NTop]: NTop General Configuration Mr? That makes me feel old, but then I am so I guess its appropriate. If you "purchased" something, yes it comes with support. I can not comment on said support, I know nothing of it. There are numerous people on this list, but many don't have patience to answer the repeative basic type questions. They just figure (perhaps rightly so) if someone can't take the time to read docs, why should they take their time to answer the questions? Regardless, if you purchased support you should have terms and conditions; such as email with (4) hour response. As noted I know nothing about paid support so... From: Abel, Jacob [mailto:[email protected]] Sent: Thursday, May 26, 2011 08:51 AM To: [email protected] <[email protected]> Subject: Re: [Ntop] [NTop]: NTop General Configuration So where exactly is this “1 year of installation support” touted on the NTop shop website? You seem to be it, Mr. Gatten. From: [email protected] [mailto:[email protected]] On Behalf Of Gary Gatten Sent: Thursday, May 26, 2011 9:47 AM To: '[email protected]' Subject: Re: [Ntop] [NTop]: NTop General Configuration To get started I recommend you read the man page and FAQ. Many of your questions will be answered there. For netflow you need to create a netflow adaptor/listener and then point your cisco exporter at it, specify the ip addy and udp port of the netflow adaptor in ntop. Ensure you have "flow-cache" enabled on the interface(s) you desire to monitor in the appropriate direction (ingress or egress - or both) G From: Sebastien Bouvet [mailto:[email protected]] Sent: Thursday, May 26, 2011 05:17 AM To: [email protected] <[email protected]> Subject: [Ntop] [NTop]: NTop General Configuration Hi I'm wondering if a documentation about NTop is available? I have already downloaded a documentation made by Mukom Akong Tamon in 2008. It is really interesting if you want to have an overview about NTop, but I miss configuration explanations to use it in a datacenter network. Can you provide me some information about that? I also have a question about the NetFlow feature. - I have connected my NTop server to my company's network. - I have configured NetFlow according to Cisco's docs on the Catalysts. I have set an IP address to one of my server interfaces: - On this interface I receive traffic from my datacenter and I configured NetFlow Data Export on Catalyst to send NetFlow flows to the same interface. My question is: How can I select only NetFlow flows on this interface? I created a NetFlow device in NTop and I'm wondering if I need to set the Virtual NetFlow Interface Network Address option? What does this option means? (I do not clearly understand the explanations given below the settings) Do I need to set this option by giving the same IP address as my interface IP adress? (I hope I have been clear in my explanations.) Thanks in advance for all the help you can provide me. -- Sébastien [http://corporate.airfrance.com/fileadmin/dossiers/images/logo_disclaimerAF.gif] Accédez aux meilleurs tarifs Air France, gérez vos réservations et enregistrez-vous en ligne sur http://www.airfrance.com Find best Air France fares, manage your reservations and check in online at http://www.airfrance.com ________________________________ Les données et renseignements contenus dans ce message peuvent être de nature confidentielle et soumis au secret professionnel et sont destinés à l'usage exclusif du destinataire dont les coordonnées figurent ci-dessus. Si vous recevez cette communication par erreur, nous vous demandons de ne pas la copier, l'utiliser ou la divulguer. Nous vous prions de notifier cette erreur à l'expéditeur et d'effacer immédiatement cette communication de votre système. Société Air France - Société anonyme au capital de 1 901 231 625 euros - RCS Bobigny (France) 420 495 178 - 45, rue de Paris, 95 747 Roissy CDG CEDEX The data and information contained in this message may be confidential and subject to professional secrecy and are intended for the exclusive use of the recipient at the address shown above. If you receive this message by mistake, we ask you not to copy, use or disclose it. Please notify this error to the sender immediately and delete this message from your system. Société Air France - Limited company with capital of 1,901,231,625 euros - Bobigny register of companies (France) 420 495 178 - 45, rue de Paris, 95 747 Roissy CDG CEDEX ________________________________ Pensez à l'environnement avant d'imprimer ce message. Think of the environment before printing this mail. "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>
_______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
