Re: [Nfsen-discuss] Re: oddity after upgrade (lack of data)

[Ivan A. B. <iv...@li...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 31/03/2006 06:22, Brian Jones wrote:
> On 3/29/06, Brian Jones <wor...@gm...> wrote:
>>  I upgraded to the lastest snapshot (thanks for adding this Peter) because
>> I wanted the ability to add new sources.
>> Unfortunately even though I have 10GB or so of flow logs it didn't seen to
>> processs them in to the RRD.
>>
>> I didn't make some changes to NfsenRRD.pm to make the RRAs large (but I've
>> done this in the past without trouble).
<snip nfsen -l output>

>> You can see it starts March 11th, but I'm only seeing data from the time I
>> did the upgrade.
>>
>> My only other thought is I may have changed the collector names at some
>> point in the process, but I don't think that should impact the old logs?

The collector names, are used within the profiles (at least to create
source directory names in $PROFILEDATA and also within the profile RRD
files). I don't know the exact effect of changing source names, but
assume you would at least need to change the corresponding directory
names and entries in the RRD files.

If you don't, I expect nfsen treats the new names as new sources so
(obviously) it has no history to them.

This is assumption, as I've never done this.

> I also noticed this in the logs...
>
> Mar 30 21:16:34 cactiv2 nfsen[16340]: ERROR Update RRD time:
> '200603291815', db: 'anaheim_out', profile: 'live': ERROR while
> updating RRD DB anaheim_out.rrd: illegal attempt to update using time
> 1143684900 when last update time is 1143781500 (minimum one second
> step)

That is saying that it's already past the time you are trying to update
(eg it's latest datapoint is 10:30 and you are trying to add an update
from 10:20). I'm not sure at why it tries this, but still.

The action I would try would be a rebuild of all profiles, with
"nfsen -r". AIUI this should rebuild your RRD files (etc) from the
nfcapd logfiles you have. It may mean that you lose any RRD history from
logfiles that have already been deleted ... but that doesn't appear to
be a problem for you ;)

Cheers


Ivan
- --
Ivan Beveridge
<iv...@li...>		http://www.linx.net/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFELQRbQQZN5jq7vncRAjiNAJ0Z0GJ1Yo4VAjEf8u8rKaDeb9jQAwCfWUui
E5PTuUhOfq7tsbkBO1NexTU=
=491I
-----END PGP SIGNATURE-----