Re: [pmacct-discussion] Off by one warning?
Paolo, Sorry I missed that you had replied. Yes, these happen all the time. There's a big burst on startup and then a pretty steady one afterwards. It looks like the later burst might be due to sending two streams? INFO ( testing/print ): *** Purging cache - START *** INFO ( testing/print ): *** Purging cache - END (QN: 6, ET: 0) *** WARN: expecting flow '25593234' but received '234608' collector=0.0.0.0:6001agent=X:0 WARN: expecting flow '234609' but received '25593234' collector=0.0.0.0:6001agent=X:0 WARN: expecting flow '25593299' but received '234609' collector=0.0.0.0:6001agent=X:0 WARN: expecting flow '234610' but received '25593299' collector=0.0.0.0:6001agent=X:0 WARN: expecting flow '25593367' but received '234610' collector=0.0.0.0:6001agent=X:0 WARN: expecting flow '234611' but received '25593367' collector=0.0.0.0:6001agent=X:0 INFO ( testing/print ): *** Purging cache - START *** INFO ( testing/print ): *** Purging cache - END (QN: 7, ET: 0) *** WARN: expecting flow '25593429' but received '234611' collector=0.0.0.0:6001agent=X:0 WARN: expecting flow '234612' but received '25593429' collector=0.0.0.0:6001agent=X:0 WARN: expecting flow '25593510' but received '234612' collector=0.0.0.0:6001agent=X:0 WARN: expecting flow '234613' but received '25593510' collector=0.0.0.0:6001agent=X:0 WARN: expecting flow '25593572' but received '234613' collector=0.0.0.0:6001agent=X:0 WARN: expecting flow '234614' but received '25593572' collector=0.0.0.0:6001agent=X:0 See how the flow numbers flip back and forth between 234k and 25M? I'm willing to disable checks, but I wouldn't want to miss other debug information in my testing. Cheers, Joel On Mon, Nov 11, 2013 at 3:16 PM, Paolo Lucente pa...@pmacct.net wrote: Hi Joel, Could also be packets are received out of order, which can be harmless depending on the use-cases. Anyway if annoying these messages can be disabled by setting nfacctd_disable_checks to true. I propose this idea because i don't seem to have seen such warnings on a regular basis on other IPFIX exports. Maybe would help if you can define better frequently. Is that like in always, at times, in specific times of the day, or ..? Cheers, Paolo On Sun, Nov 10, 2013 at 06:26:22PM -0800, Joel Krauska wrote: (I should have mentioned I'm testing rc1 NetFlow Accounting Daemon, nfacctd 1.5.0rc1 (20130829-00) --enable-mysql --enable-64bit --enable-threads --enable-geoip I frequently get these Warnings. WARN: expecting flow '4423369' but received '4423371' collector=0.0.0.0:6001agent=BLAH:0 WARN: expecting flow '4423371' but received '4423372' collector=0.0.0.0:6001agent=BLAH:0 WARN: expecting flow '4423372' but received '4423374' collector=0.0.0.0:6001agent=BLAH:0 WARN: expecting flow '4423374' but received '4423375' collector=0.0.0.0:6001agent=BLAH:0 WARN: expecting flow '4423375' but received '4423376' collector=0.0.0.0:6001agent=BLAH:0 It seems odd to see them in series like this, since the 'expected' usually is the one it just received just before... Looks like possibly an off by 1 error? Cheers, Joel ___ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists ___ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists ___ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
Re: [pmacct-discussion] Off by one warning?
Hi Joel, Disabling checks is harmless, apart from having the benefit of removing you the annoying part of those warning messages. But one more question: you say sending two streams but i see only a single exporter, 'agent=X:0'. Is it X reallt corresponding to a single IP address (which would justify the warnings) or not? If yes, would it be possible for you to send me privately a brief trace of the export packets from that agent? Cheers, Paolo On Wed, Dec 04, 2013 at 03:53:04PM -0800, Joel Krauska wrote: Paolo, Sorry I missed that you had replied. Yes, these happen all the time. There's a big burst on startup and then a pretty steady one afterwards. It looks like the later burst might be due to sending two streams? INFO ( testing/print ): *** Purging cache - START *** INFO ( testing/print ): *** Purging cache - END (QN: 6, ET: 0) *** WARN: expecting flow '25593234' but received '234608' collector=0.0.0.0:6001agent=X:0 WARN: expecting flow '234609' but received '25593234' collector=0.0.0.0:6001agent=X:0 WARN: expecting flow '25593299' but received '234609' collector=0.0.0.0:6001agent=X:0 WARN: expecting flow '234610' but received '25593299' collector=0.0.0.0:6001agent=X:0 WARN: expecting flow '25593367' but received '234610' collector=0.0.0.0:6001agent=X:0 WARN: expecting flow '234611' but received '25593367' collector=0.0.0.0:6001agent=X:0 INFO ( testing/print ): *** Purging cache - START *** INFO ( testing/print ): *** Purging cache - END (QN: 7, ET: 0) *** WARN: expecting flow '25593429' but received '234611' collector=0.0.0.0:6001agent=X:0 WARN: expecting flow '234612' but received '25593429' collector=0.0.0.0:6001agent=X:0 WARN: expecting flow '25593510' but received '234612' collector=0.0.0.0:6001agent=X:0 WARN: expecting flow '234613' but received '25593510' collector=0.0.0.0:6001agent=X:0 WARN: expecting flow '25593572' but received '234613' collector=0.0.0.0:6001agent=X:0 WARN: expecting flow '234614' but received '25593572' collector=0.0.0.0:6001agent=X:0 See how the flow numbers flip back and forth between 234k and 25M? I'm willing to disable checks, but I wouldn't want to miss other debug information in my testing. Cheers, Joel On Mon, Nov 11, 2013 at 3:16 PM, Paolo Lucente pa...@pmacct.net wrote: Hi Joel, Could also be packets are received out of order, which can be harmless depending on the use-cases. Anyway if annoying these messages can be disabled by setting nfacctd_disable_checks to true. I propose this idea because i don't seem to have seen such warnings on a regular basis on other IPFIX exports. Maybe would help if you can define better frequently. Is that like in always, at times, in specific times of the day, or ..? Cheers, Paolo On Sun, Nov 10, 2013 at 06:26:22PM -0800, Joel Krauska wrote: (I should have mentioned I'm testing rc1 NetFlow Accounting Daemon, nfacctd 1.5.0rc1 (20130829-00) --enable-mysql --enable-64bit --enable-threads --enable-geoip I frequently get these Warnings. WARN: expecting flow '4423369' but received '4423371' collector=0.0.0.0:6001agent=BLAH:0 WARN: expecting flow '4423371' but received '4423372' collector=0.0.0.0:6001agent=BLAH:0 WARN: expecting flow '4423372' but received '4423374' collector=0.0.0.0:6001agent=BLAH:0 WARN: expecting flow '4423374' but received '4423375' collector=0.0.0.0:6001agent=BLAH:0 WARN: expecting flow '4423375' but received '4423376' collector=0.0.0.0:6001agent=BLAH:0 It seems odd to see them in series like this, since the 'expected' usually is the one it just received just before... Looks like possibly an off by 1 error? Cheers, Joel ___ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists ___ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists ___ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
Re: [pmacct-discussion] Off by one warning?
Sure thing. On Wed, Dec 4, 2013 at 4:37 PM, Paolo Lucente pa...@pmacct.net wrote: Hi Joel, Disabling checks is harmless, apart from having the benefit of removing you the annoying part of those warning messages. But one more question: you say sending two streams but i see only a single exporter, 'agent=X:0'. Is it X reallt corresponding to a single IP address (which would justify the warnings) or not? If yes, would it be possible for you to send me privately a brief trace of the export packets from that agent? Cheers, Paolo On Wed, Dec 04, 2013 at 03:53:04PM -0800, Joel Krauska wrote: Paolo, Sorry I missed that you had replied. Yes, these happen all the time. There's a big burst on startup and then a pretty steady one afterwards. It looks like the later burst might be due to sending two streams? INFO ( testing/print ): *** Purging cache - START *** INFO ( testing/print ): *** Purging cache - END (QN: 6, ET: 0) *** WARN: expecting flow '25593234' but received '234608' collector=0.0.0.0:6001agent=X:0 WARN: expecting flow '234609' but received '25593234' collector=0.0.0.0:6001agent=X:0 WARN: expecting flow '25593299' but received '234609' collector=0.0.0.0:6001agent=X:0 WARN: expecting flow '234610' but received '25593299' collector=0.0.0.0:6001agent=X:0 WARN: expecting flow '25593367' but received '234610' collector=0.0.0.0:6001agent=X:0 WARN: expecting flow '234611' but received '25593367' collector=0.0.0.0:6001agent=X:0 INFO ( testing/print ): *** Purging cache - START *** INFO ( testing/print ): *** Purging cache - END (QN: 7, ET: 0) *** WARN: expecting flow '25593429' but received '234611' collector=0.0.0.0:6001agent=X:0 WARN: expecting flow '234612' but received '25593429' collector=0.0.0.0:6001agent=X:0 WARN: expecting flow '25593510' but received '234612' collector=0.0.0.0:6001agent=X:0 WARN: expecting flow '234613' but received '25593510' collector=0.0.0.0:6001agent=X:0 WARN: expecting flow '25593572' but received '234613' collector=0.0.0.0:6001agent=X:0 WARN: expecting flow '234614' but received '25593572' collector=0.0.0.0:6001agent=X:0 See how the flow numbers flip back and forth between 234k and 25M? I'm willing to disable checks, but I wouldn't want to miss other debug information in my testing. Cheers, Joel On Mon, Nov 11, 2013 at 3:16 PM, Paolo Lucente pa...@pmacct.net wrote: Hi Joel, Could also be packets are received out of order, which can be harmless depending on the use-cases. Anyway if annoying these messages can be disabled by setting nfacctd_disable_checks to true. I propose this idea because i don't seem to have seen such warnings on a regular basis on other IPFIX exports. Maybe would help if you can define better frequently. Is that like in always, at times, in specific times of the day, or ..? Cheers, Paolo On Sun, Nov 10, 2013 at 06:26:22PM -0800, Joel Krauska wrote: (I should have mentioned I'm testing rc1 NetFlow Accounting Daemon, nfacctd 1.5.0rc1 (20130829-00) --enable-mysql --enable-64bit --enable-threads --enable-geoip I frequently get these Warnings. WARN: expecting flow '4423369' but received '4423371' collector=0.0.0.0:6001agent=BLAH:0 WARN: expecting flow '4423371' but received '4423372' collector=0.0.0.0:6001agent=BLAH:0 WARN: expecting flow '4423372' but received '4423374' collector=0.0.0.0:6001agent=BLAH:0 WARN: expecting flow '4423374' but received '4423375' collector=0.0.0.0:6001agent=BLAH:0 WARN: expecting flow '4423375' but received '4423376' collector=0.0.0.0:6001agent=BLAH:0 It seems odd to see them in series like this, since the 'expected' usually is the one it just received just before... Looks like possibly an off by 1 error? Cheers, Joel ___ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists ___ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists ___ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
Re: [pmacct-discussion] Off by one warning?
Hi Joel, Could also be packets are received out of order, which can be harmless depending on the use-cases. Anyway if annoying these messages can be disabled by setting nfacctd_disable_checks to true. I propose this idea because i don't seem to have seen such warnings on a regular basis on other IPFIX exports. Maybe would help if you can define better frequently. Is that like in always, at times, in specific times of the day, or ..? Cheers, Paolo On Sun, Nov 10, 2013 at 06:26:22PM -0800, Joel Krauska wrote: (I should have mentioned I'm testing rc1 NetFlow Accounting Daemon, nfacctd 1.5.0rc1 (20130829-00) --enable-mysql --enable-64bit --enable-threads --enable-geoip I frequently get these Warnings. WARN: expecting flow '4423369' but received '4423371' collector=0.0.0.0:6001agent=BLAH:0 WARN: expecting flow '4423371' but received '4423372' collector=0.0.0.0:6001agent=BLAH:0 WARN: expecting flow '4423372' but received '4423374' collector=0.0.0.0:6001agent=BLAH:0 WARN: expecting flow '4423374' but received '4423375' collector=0.0.0.0:6001agent=BLAH:0 WARN: expecting flow '4423375' but received '4423376' collector=0.0.0.0:6001agent=BLAH:0 It seems odd to see them in series like this, since the 'expected' usually is the one it just received just before... Looks like possibly an off by 1 error? Cheers, Joel ___ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists ___ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
