Re: [Nfdump-discuss] nfcapd fails to rotate files every 7/8 hours

[Veerapuram V. <vva...@no...>]

Hi Peter,

Hope you had a nice vacation.  When nfcapd stops rotating files, there
are a few things that I noted from the .nfstat file.

houengv205:/var/opt/netflow/nfdump # cat .nfstat
first=1375892354
last=1375892354
size=18446744073656061952
maxsize=0
numfiles=0
lifetime=604800
watermark=1
status=3

Above is the content of .nfstat when nfcapd had stopped rotating files
for more than 24 hours.  As you can see, first and last shows the same
timestamp and size is totally random.  Same is the case of numfiles,
which is more than 500 as per the ls output in that directory.

When I restarted nfcapd, it updated the .nfstat as: 

houengv205:/var/opt/netflow/nfdump # cat .nfstat
first=1375886400
last=1376214000
size=1980444672
maxsize=0
numfiles=547
lifetime=604800
watermark=1
status=0

The command line (arguments to nfcapd) is : 
/opt/novell/sentinel/3rdparty/nfdump/bin/nfcapd -t 600
-l /var/opt/novell/sentinel/data/netflow/nfdump -p 3578 -T all -w -B
104857600 

ls output from nfcapd data directory:

-rw------- 1 novell novell 1.3M Aug 11 03:40 nfcapd.201308110330
-rw------- 1 novell novell 1.4M Aug 11 03:50 nfcapd.201308110340
-rw------- 1 novell novell 1.3M Aug 11 04:00 nfcapd.201308110350
-rw------- 1 novell novell 1.3M Aug 11 04:10 nfcapd.201308110400
-rw------- 1 novell novell 1.4M Aug 11 04:20 nfcapd.201308110410
-rw------- 1 novell novell 1.3M Aug 11 04:30 nfcapd.201308110420
-rw------- 1 novell novell 1.4M Aug 11 04:40 nfcapd.201308110430
-rw------- 1 novell novell 1.3M Aug 11 04:50 nfcapd.201308110440
-rw------- 1 novell novell  276 Aug 12 05:40 nfcapd.current.8635

Also, just an observation (could be wrong), ever since nfcapd started
writing to nfcapd.current.<pid>, I guess, there are issues w.r.t it when
it gets restarted after a kill or some such, because, when previous
versions of nfcapd kept it as nfcapd.current - a restart was able to
pick up what was left in nfcapd.current.  I am just pointing to an
unclean shutdown of nfcapd process.

Let me know if you need any further detail.

Best,

V. Varadhan

On Mon, 2013-08-12 at 08:19 +0200, Peter Haag wrote:
> Hi,
> Hmm  .. I'm not aware of any file rotate issues. 1.6.10 has some bugs - 1.6.10p1 will follow in a few days.
> Sorry for not responding earlier - I was on holiday.
> 
> 	- Peter
> 
> 
> On 7/22/13 W30 10:35, Veerapuram Varadhan wrote:
> > Hi,
> > 
> > I have been running nfcapd 1.6.10 and have observed that nfcapd fails to
> > rotate the files in about 7 or 8 hours.  
> > 
> > I am running nfcapd with -P option from a program to be able to
> > start/stop it as below:
> > 
> > nfcapd -T all -w -B 1024000 -t 60 -l /var/opt/nfdump -p 3578
> > -P /var/run/nfcapd.pid
> > 
> > I am not sure on what all details to provide in order to be able to get
> > a clue of what is happening.
> > 
> > Let me know from where to start debugging it. Googling also didn't help
> > much in tracking the issue.
> > 
> > Kindly let me know of any options to figure what is happening.  This is
> > currently a major concern in using nfdump tools.
> > 
> > Best,
> > 
> > V. Varadhan
> > 
> > 
> > 
> > 
> > 
> > ------------------------------------------------------------------------------
> > See everything from the browser to the database with AppDynamics
> > Get end-to-end visibility with application monitoring from AppDynamics
> > Isolate bottlenecks and diagnose root cause in seconds.
> > Start your free trial of AppDynamics Pro today!
> > http://pubads.g.doubleclick.net/gampad/clk?id=48808831&iu=/4140/ostg.clktrk
> > _______________________________________________
> > Nfdump-discuss mailing list
> > Nfd...@li...
> > https://lists.sourceforge.net/lists/listinfo/nfdump-discuss
> > 
>