Re: [Nfdump-discuss] nfcapd fails to rotate files every 7/8 hours

[Peter H. <ph...@us...>]

Can you please check the syslog daemon file for error messages?

	- Peter

On 8/12/13 W33 12:54, Veerapuram Varadhan wrote:
> Hi Peter,
> 
> Hope you had a nice vacation.  When nfcapd stops rotating files, there
> are a few things that I noted from the .nfstat file.
> 
> houengv205:/var/opt/netflow/nfdump # cat .nfstat
> first=1375892354
> last=1375892354
> size=18446744073656061952
> maxsize=0
> numfiles=0
> lifetime=604800
> watermark=1
> status=3
> 
> Above is the content of .nfstat when nfcapd had stopped rotating files
> for more than 24 hours.  As you can see, first and last shows the same
> timestamp and size is totally random.  Same is the case of numfiles,
> which is more than 500 as per the ls output in that directory.
> 
> When I restarted nfcapd, it updated the .nfstat as: 
> 
> houengv205:/var/opt/netflow/nfdump # cat .nfstat
> first=1375886400
> last=1376214000
> size=1980444672
> maxsize=0
> numfiles=547
> lifetime=604800
> watermark=1
> status=0
> 
> The command line (arguments to nfcapd) is : 
> /opt/novell/sentinel/3rdparty/nfdump/bin/nfcapd -t 600
> -l /var/opt/novell/sentinel/data/netflow/nfdump -p 3578 -T all -w -B
> 104857600 
> 
> ls output from nfcapd data directory:
> 
> -rw------- 1 novell novell 1.3M Aug 11 03:40 nfcapd.201308110330
> -rw------- 1 novell novell 1.4M Aug 11 03:50 nfcapd.201308110340
> -rw------- 1 novell novell 1.3M Aug 11 04:00 nfcapd.201308110350
> -rw------- 1 novell novell 1.3M Aug 11 04:10 nfcapd.201308110400
> -rw------- 1 novell novell 1.4M Aug 11 04:20 nfcapd.201308110410
> -rw------- 1 novell novell 1.3M Aug 11 04:30 nfcapd.201308110420
> -rw------- 1 novell novell 1.4M Aug 11 04:40 nfcapd.201308110430
> -rw------- 1 novell novell 1.3M Aug 11 04:50 nfcapd.201308110440
> -rw------- 1 novell novell  276 Aug 12 05:40 nfcapd.current.8635
> 
> Also, just an observation (could be wrong), ever since nfcapd started
> writing to nfcapd.current.<pid>, I guess, there are issues w.r.t it when
> it gets restarted after a kill or some such, because, when previous
> versions of nfcapd kept it as nfcapd.current - a restart was able to
> pick up what was left in nfcapd.current.  I am just pointing to an
> unclean shutdown of nfcapd process.
> 
> Let me know if you need any further detail.
> 
> Best,
> 
> V. Varadhan
> 
> On Mon, 2013-08-12 at 08:19 +0200, Peter Haag wrote:
>> Hi,
>> Hmm  .. I'm not aware of any file rotate issues. 1.6.10 has some bugs - 1.6.10p1 will follow in a few days.
>> Sorry for not responding earlier - I was on holiday.
>>
>> 	- Peter
>>
>>
>> On 7/22/13 W30 10:35, Veerapuram Varadhan wrote:
>>> Hi,
>>>
>>> I have been running nfcapd 1.6.10 and have observed that nfcapd fails to
>>> rotate the files in about 7 or 8 hours.  
>>>
>>> I am running nfcapd with -P option from a program to be able to
>>> start/stop it as below:
>>>
>>> nfcapd -T all -w -B 1024000 -t 60 -l /var/opt/nfdump -p 3578
>>> -P /var/run/nfcapd.pid
>>>
>>> I am not sure on what all details to provide in order to be able to get
>>> a clue of what is happening.
>>>
>>> Let me know from where to start debugging it. Googling also didn't help
>>> much in tracking the issue.
>>>
>>> Kindly let me know of any options to figure what is happening.  This is
>>> currently a major concern in using nfdump tools.
>>>
>>> Best,
>>>
>>> V. Varadhan
>>>
>>>
>>>
>>>
>>>
>>> ------------------------------------------------------------------------------
>>> See everything from the browser to the database with AppDynamics
>>> Get end-to-end visibility with application monitoring from AppDynamics
>>> Isolate bottlenecks and diagnose root cause in seconds.
>>> Start your free trial of AppDynamics Pro today!
>>> http://pubads.g.doubleclick.net/gampad/clk?id=48808831&iu=/4140/ostg.clktrk
>>> _______________________________________________
>>> Nfdump-discuss mailing list
>>> Nfd...@li...
>>> https://lists.sourceforge.net/lists/listinfo/nfdump-discuss
>>>
>>
> 
> 
> 
> ------------------------------------------------------------------------------
> Get 100% visibility into Java/.NET code with AppDynamics Lite!
> It's a free troubleshooting tool designed for production.
> Get down to code-level detail for bottlenecks, with <2% overhead. 
> Download for free and get started troubleshooting in minutes. 
> http://pubads.g.doubleclick.net/gampad/clk?id=48897031&iu=/4140/ostg.clktrk
> _______________________________________________
> Nfdump-discuss mailing list
> Nfd...@li...
> https://lists.sourceforge.net/lists/listinfo/nfdump-discuss
> 

-- 
--
Be nice to your netflow data