Error starting FlowMonitor_Collector ; Silk

[Jason Wicks]

Hello,

I am having some issues getting the FlowMonitor to work correctly. I

When starting FlowMonitor_Collector, I get a bunch of these errors:

[root@Nagios001-24C FlowViewer_4.5]# rwfilter: Must specify partitioning rules when using --pass-destination
Use 'rwfilter --help' for usage
rwcount: Error processing headers on file '-': Unexpected end of file while reading header
rwfilter: Must specify partitioning rules when using --pass-destination
Use 'rwfilter --help' for usage
rwcut: Error processing headers on file '-': Unexpected end of file while reading header
rwfilter: Must specify partitioning rules when using --pass-destination
Use 'rwfilter --help' for usage
rwcount: Error processing headers on file '-': Unexpected end of file while reading header
</snip>

When I look at the last entry in DEBUG_MONITOR_C:

/var/www/cgi-bin/FlowMonitor_Files/FlowMonitor_Filters/test_monitor_-flow-_flows_active-s.fil
from: start next_filter to: start SiLK_processing elapsed seconds: 0.001722 running: 7200.173657
silk_command: /usr/local/bin/rwfilter --site-config-file=/data/silk.conf --pass=stdout /var/www/cgi-bin/FlowViewer_4.5/Flow_Working/FlowMonitor_Prefiltered_Site_all | /usr/local/bin/rwcut --site-config-file=/data/silk.conf --fields=22,23,10,13,1,3,14,2,4,5,8,6,7 > /var/www/cgi-bin/FlowViewer_4.5/Flow_Working/FlowMonitor_Collector_output
from: start SiLK_processing to: end SiLK_processing elapsed seconds: 0.005951 running: 7200.179608
from: end SiLK_processing to: start flows_active elapsed seconds: 0.000065 running: 7200.179673
from: start flows_active to: end flows_active elapsed seconds: 0.000091 running: 7200.179764
from: end flows_active to: start RRDtool_update elapsed seconds: 0.001383 running: 7200.181147
Test Monitor - Flow - flows active/s 1423521000:0
from: start RRDtool_update to: end RRDtool_update elapsed seconds: 0.003304 running: 7200.184451
from: end RRDtool_update to: end this_filter elapsed seconds: 0.000064 running: 7200.184515

Then run the command above I get the same error:

[root@Nagios001-24C FlowViewer_4.5]# /usr/local/bin/rwfilter --site-config-file=/data/silk.conf --pass=stdout /var/www/cgi-bin/FlowViewer_4.5/Flow_Working/FlowMonitor_Prefiltered_Site_all | /usr/local/bin/rwcut --site-config-file=/data/silk.conf --fields=22,23,10,13,1,3,14,2,4,5,8,6,7 > /var/www/cgi-bin/FlowViewer_4.5/Flow_Working/FlowMonitor_Collector_output
rwfilter: Must specify partitioning rules when using --pass-destination
Use 'rwfilter --help' for usage
rwcut: Error processing headers on file '-': Unexpected end of file while reading header

I think I migt have some time/date issues as well, but I am thoroughly stuck.

Any assistance is greatly appreciated.

Sincerely,

-Jason

[Joe Loiacono]

Hi Jason,

Thanks for using FlowViewer. Sorry you're having this problem.

There's something peculiar about your FlowMonitor Label. Just for testing can you try a very 'vanilla' name like Test Monitor Flows Active (no special characters)?

Maybe closer to the problem is a blank filter. The way FlowViewer is now you need to filter on something. For example, with 'flows active' I might pick out an interface, etc. I guess if you don't have a filter you can skip the rwfilter command - I'll have to look at this and fix it if that is the case. For testing can you put in some filter?

Also - Randy Feeney and I have been working some time issues around using local time (versus UTC). Can you describe your environment:

Which timezone is (local or UTC):

1) Exporting router
2) System time
3) SiLK compiled time

In the meantime, try out an early version of FlowViewer_4.6 (attached) which corrects some local timezone issues.

Thanks,

Joe