Bug in Flow Monitors when using 'Other Switches' parameter

[Jon Shea]

I found a bug in the FlowMonitor_Collector code, when using the 'Other Switches' parameter in the monitor. At around line 475, the code checks to see if the prefiltered file already exists, and if it does, it uses that for the current filter. The problem is, the prefiltered files name is comprised of the silk_class, silk_flowtype, silk_type, and silk_sensors, but not the silk_switches. In my case, I have multiple monitors with identical class, flowtype, type, and sensors, but different switches. This caused the collector to use the prefiltered file of whatever the first monitor it parsed, for all the other monitors.

I got around this by removing the prefiltered file and regenerating it for each monitor, although this is inefficient and there are better solutions, this was just a quick fix.

Just bringing this to your attention if you haven't seen it before, it would be nice to see this fixed in future versions.

[Joe Loiacono]

Thank you Jon. Nice work.

I'll see if I can get this tested out soon. In the meantime it looks like you could simply modify line 467 in FowMonitor_Collector to the following:

$silk_suffix = $silk_class . $silk_flowtype . $silk_type . $silk_sensors . $silk_switches;

Joe