Can't create FlowMonitor_Group
FlowViewer is a web-based netflow data analysis tool.
Brought to you by:
jloiacon
Menu
▾
▴
Hello,
I'm running FlowViewer with Silk and I can't create FlowMonitor_Group.
I have created six FlowMonitors and they are working (graphing, sending mails...).
I followed steps:
To create a Group:
Click on a FlowMonitor button (to go to FlowMonitor input screen)
Provide a FlowMonitor Label
Select 'Group" from FlowMonitor Type
Click on Create FlowMonitor
Select existing FlowMonitors, one at a time, that you wish to include in the group
Adjust color and position as you like
Hit enter
I get Internal Server error :
"[Sat May 14 19:30:17.194469 2016] [cgid:error] [pid 4846:tid 139954512451328] [client 10.1.14.135:52526] malformed header from script 'FlowMonitor_Group.cgi':
Bad header: div id=content_wide"
"Can't open group file: /usr/lib/cgi-bin/FlowViewer_4.6/FlowMonitor_Files/FlowMonitor_Filters/.grp at /usr/lib/cgi-bin/FlowViewer_4.6/FlowMonitor_Group.cgi line 673, <COLORS> line 153."
When i check perl -c FlowMonitor_Group.cgi i get "FlowMonitor_Group.cgi syntax OK"
Please help if you know or can.
Best regards
Last edit: Domagoj 2016-05-14
Domagoj,
You need to provide a name (Monitor Label) for the Group. Looks like you may have not provided that.
Joe
Hello Joe,
Thank you for support.
I have provided (Monitor Label) TestGroup1, and FlowMonitor_Main.cgi is responding now with message:
"Recreates are permitted for Individual FlowMonitors only. New Groups will extend back in time as far back as the existing component Individual FlowMonitors already go. They will appear fully with the next run of FlowGrapher. If you wish to Recreate a Group from new FlowMonitors, Recreate the Individual FlowMonitors first.".
My FlowMonitors are not showing sa I cannot pick them (image is in attach).
As I mentioned earlier I have created Individual FlowMonitors and they are working.
When I check DEBUG_GROUP i get of course nothing:
In FlowMonitor_Group.cgi...
NO QUERY_STRING ARGV[0]: ARGV[1]:
active_dashboard: action: component_label:
ARGV[0]:
ARGV[1]:
active_dashboard:
action:
monitor_info:
monitor_label:
monitor_file:
general_comment:
revision_comment:
group_file: /usr/lib/cgi-bin/FlowViewer_4.6/FlowMonitor_Files/FlowMonitor_Filters/.grp
In apache log:
/bin/rm: cannot remove '/usr/lib/cgi-bin/FlowViewer_4.6/Flow_Working/FlowMonitor_Recreate_concat_100551XB': No such file or directory
/bin/rm: cannot remove '/usr/lib/cgi-bin/FlowViewer_4.6/Flow_Working/FMR_buckets_cfg_100551XB': No such file or directory
cp: cannot stat '/var/www/FlowMonitor/testgroup1/*': No such file or directory
mv: cannot stat '/usr/lib/cgi-bin/FlowViewer_4.6/FlowMonitor_Files/FlowMonitor_Filters/testgroup1.grp': No such file or directory
mv: cannot stat '/usr/lib/cgi-bin/FlowViewer_4.6/FlowMonitor_Files/FlowMonitor_Filters/testgroup1.archive': No such file or directory
mv: cannot stat '/usr/lib/cgi-bin/FlowViewer_4.6/FlowMonitor_Files/FlowMonitor_RRDtool/testgroup1.archive': No such file or directory
/bin/rm: cannot remove '/usr/lib/cgi-bin/FlowViewer_4.6/Flow_Working/FlowMonitor_Recreate_concat_101319JG': No such file or directory
/bin/rm: cannot remove '/usr/lib/cgi-bin/FlowViewer_4.6/Flow_Working/FMR_buckets_cfg_101319JG': No such file or directory
Last edit: Domagoj 2016-05-26
Domagoj,
Groups cannot be "re-created" so do not supply a start time. Please blank it out and try again.
Joe
Hy Joe,
I blanked out start time, and now i get "Internal Server Error", apache error log says:
"[Thu May 26 15:54:33.129512 2016] [cgid:error] [pid 1103:tid 140130903529216] [client 10.1.14.135:55173] End of script output before headers: FlowMonitor_Main.cgi, referer: http://10.1.14.204/cgi-bin/FlowViewer_4.6/FlowMonitor.cgi?Performance^filter_hash=FM_^DDDSite"
I ran chmod 755 on FlowMonitor_Main.cgi, and again "Internal Server Error".
Thanks for help.
Last edit: Domagoj 2016-05-26
Domagoj,
Sorry - it's been awhile. Don't clear out the start time but leave it as it defaults. Also you do have RRDs installed successfully (see Uer's Guide).
Joe
Hy Joe
The Groups are working now, it all works great for now. Thank you once more for your support.
Btw, i was occupied with CERT NetSA tool 'pipeline', it is alerting tool for SiLK basically.
https://tools.netsa.cert.org/analysis-pipeline5/
Best regards
Domagaj,
Glad to hear it's working. The 'pipeline' sounds pretty good. Note that FlowViewer also allows you to alert off of FlowMonitor updates. It will send email alerts when a prevoiusly configured threshold is crossed (either above or below.) You can also email to your mobile carrier for SMS messages if you're so brave.
Best!