It sees as the process can not write to the disk at all! If the collector
can write, an empty flow fie has 276 bytes in size. So a size of 0 means
it can not write at all. Have you checked the syslogs log daemon file?
The collector does report any errors to this file.
Maybe disk full or anything like this? Apart from that, I have no idea.
- Peter
On 12/14/12 22:47, Kynan Lalone wrote:
> I'm having an issue with sfcapd:
>
> I have a juniper ex4200 (10.1.1.1) set to send sflow samples to my
> collector (10.1.1.5) collecting samples from a trunk interface with no
> VLANs
> set protocols sflow polling-interval 15
> set protocols sflow sample-rate 1000
> set protocols sflow source-ip 10.1.1.1
> set protocols sflow collector 10.1.1.5 udp-port 6343
> set protocols sflow interfaces ge-1/0/13.0
>
> I compiled nfdump with --enable-sflow and compiled nsfen with:
> %sources = (
> 'switch1' => { 'port' => '6343', 'col' => '#0000ff',
> 'type' => 'sflow' },
> );
>
> My first run collected sample data! I can hit up the web UI and run
> nfdump from there, the sflow data is awesome! I get really useful
> stuff... for one minute. I took a look in the collection store and
> found that after the first rotate all files were blank:
>
> collector:/usr/local/nfsen/profiles-data/live/switch1/2012/12/12$ wc -l *
> 352 nfcapd.201212120155
> 0 nfcapd.201212120200
> 0 nfcapd.201212120205
> 0 nfcapd.201212120210
> 0 nfcapd.201212120215
> 0 nfcapd.201212120220
> 0 nfcapd.201212120225
> 0 nfcapd.201212120230
> 0 nfcapd.201212120235
> 0 nfcapd.201212120240
>
>
> I tried running sfcapd by hand but I don't get anything there either:
> $ sudo sfcapd -E -B 10 -b 10.1.1.5 -4 -p 6343 -S 1 -n
> switch1,10.1.1.1,/tmp/nfdump
> File Block Header:
> NumBlocks = 0
> Size = 0
> id = 2
>
>
> When I do a "sudo tcpdump -v udp port 6343 -s 1500" I do get sflows
> from the switch:
> 11:52:07.624977 IP (tos 0x0, ttl 254, id 5728, offset 0, flags [none],
> proto UDP (17), length 1484)
> 10.1.1.1.60578 > collector.6343: sFlowv5, IPv4 agent 128.0.0.127,
> agent-id 17, seqnum 38496, uptime 1963373233, samples 8, length 1456
> flow sample (1), length 196,
> flow sample (1), length 148,
> flow sample (1), length 208,
> flow sample (1), length 208,
> flow sample (1), length 148,
> flow sample (1), length 148,
> flow sample (1), length 148,
> flow sample (1), length 160,[|SFLOW]
> 11:52:07.722853 IP (tos 0x0, ttl 254, id 5729, offset 0, flags [none],
> proto UDP (17), length 1372)
> 10.1.1.1.60578 > collector.6343: sFlowv5, IPv4 agent 128.0.0.127,
> agent-id 17, seqnum 38497, uptime 1963373331, samples 8, length 1344
> flow sample (1), length 148,
> flow sample (1), length 148,
> flow sample (1), length 156,
> flow sample (1), length 148,
> flow sample (1), length 148,
> flow sample (1), length 148,
> flow sample (1), length 148,
> flow sample (1), length 208,
>
>
> but if I strace the above sfcapd command it I found this interesting tidbit:
>
> ...
> bind(4, {sa_family=AF_INET, sin_port=htons(6343),
> sin_addr=inet_addr("10.1.1.5")}, 16) = 0
> sendto(3, "<31>Dec 12 12:04:47 sfcapd[28939"..., 80, MSG_NOSIGNAL, NULL, 0) = 80
> listen(4, 128) = -1 EOPNOTSUPP (Operation not
> supported)
> sendto(3, "<30>Dec 12 12:04:47 sfcapd[28939"..., 79, MSG_NOSIGNAL, NULL, 0) = 79
> getsockopt(4, SOL_SOCKET, SO_RCVBUF, [17179994112], [4]) = 0
> sendto(3, "<30>Dec 12 12:04:47 sfcapd[28939"..., 107, MSG_NOSIGNAL,
> NULL, 0) = 107
> setsockopt(4, SOL_SOCKET, SO_RCVBUF, [65536], 4) = 0
> getsockopt(4, SOL_SOCKET, SO_RCVBUF, [17180000256], [4]) = 0
> sendto(3, "<30>Dec 12 12:04:47 sfcapd[28939"..., 83, MSG_NOSIGNAL, NULL, 0) = 83
> ...
>
> I'm not sure where else to go from here. I read that with netflow
> data you need to export the a header every once and a while so that
> each rotation of nfdump knows how to read the file but that doesn't
> seem true with sflow.
>
> Thanks!
>
> ------------------------------------------------------------------------------
> LogMeIn Rescue: Anywhere, Anytime Remote support for IT. Free Trial
> Remotely access PCs and mobile devices and provide instant support
> Improve your efficiency, and focus on delivering more value-add services
> Discover what IT Professionals Know. Rescue delivers
> http://p.sf.net/sfu/logmein_12329d2d
> _______________________________________________
> Nfdump-discuss mailing list
> Nfdump-discuss@...
> https://lists.sourceforge.net/lists/listinfo/nfdump-discuss
>
--
--
Be nice to your netflow data
|