Sounds like an interesting problem.... The only advice I can offer now it try using some filters outside of rrd - in general ntop settings, it uses BPF syntax and controls what ntop sees which in turn controls what rrd sees.
----- Original Message ----- From: [email protected] <[email protected]> To: [email protected] <[email protected]> Sent: Thu Apr 30 20:51:26 2009 Subject: [Ntop] rrd not storing data for local subnet Greetings all, I'm having a problem saving RRD data from any host on my local subnet with the rrd-plugin in ntop versions >= 3.3.6. At least that's what it looks like. :) I haven't had a chance to compile version 3.3.0 yet and the problem does not exist in the 3.2 build included with Ubuntu 8.04.2. I've tried 3.2, 3.3.6, 3.3.8, 3.3.9, and 3.3.10rc1. We have 30 branch offices, a total of about 500 machines, and over 60 servers in the datacenter where the ntop server lives. I'm just trying to track all the interactions between the remote branches and the servers in the datacenter, so I'm capturing all the traffic that's going over our VPN router which is limited to 15M. Using the hosts filter on the rrd-plugin config page, I've been able to limit the RRD tracking to just our 30 branch subnets. But, when I have the hosts filter turned on, I am unable to store data for the local 10.1.0.0/21 subnet. (Referenced as 10.1.0.0/255.255.248.0 in the plugin). Without host filtering turned on, the box just can't handle trying to record RRD data for the thousands of hosts that end up being tracked, so this is essential. Of course, it's also essential for us to be able to track the traffic generated by the servers in our datacenter. If I only enter 10.1.0.0/255.255.248.0 in the hosts filter, then only the throughput data gets updated in RRDs. All my graphs for the servers in the 10.1.0.0/21 subnet never get any more data. Running ntop with the --trace=5 comand shows me exactly which host RRDs get updated and the local subnet always gets ignored. I've been fighting this for days now and all the google searching in the world hasn't helped me so far. I've taken to examining diffs of the ./plugins/rrdPlugin.c file in the source code of the different versions and that tells me I've gone way too far because I am not a programmer. I have found however, that since version 3.3.6, there's an extra section in rrdPlugin.c file that uses a boolean variable called 'is_subnet_host' and I don't have a clue what exactly that's doing if anything. There are a ton of changes it seems. Also, I noticed there isn't the option of saving subnet data to RRDs in the 3.2 version I'm running so perhaps that's what it's all about. I've tried different settings using the --known-subnets and --local-subnets options in combination with the -g (only record local hosts) option and nothing's working. I tried running as root, even though I knew there wasn't a permissions issue. I ran the ntop 3.3.8 build on a CentOS 5.3 server, currently the only thing that works is the ntop 3.2 build on an Ubuntu 8.04.2 server and its RRD graphing sucks because I can't zoom in on anything and the titles are missing from the graphs which makes it hard to quickly find what I'm looking for. Maybe there's a way to fix that, but I know version 3.2 uses an old rrdtool library... Anyway, I can provide more details to anyone that wants them, and I'll be forever grateful to anyone that can help me solve this problem. Thanks in advance and have a great day! Johnathan _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>
_______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
