Re: [Nfsen-discuss] oddity after upgrade (lack of data)

[Brian J. <wor...@gm...>]

I guess I'll try backing out to the "original" settings and see what
happens....

Any other input is greatly appreacited :)


On 4/7/06, Brian Jones <wor...@gm...> wrote:
>
>  Peter,
>
> This is the main (only) change I made:
>
>         RRDs::create ( $rrd_filename, "--start", $start,
>                 @DS,
>                 "RRA:AVERAGE:0.5:1:57600        ",
> #               "RRA:AVERAGE:0.5:6:1440",
> #               "RRA:AVERAGE: 0.5:24:360",
> #               "RRA:AVERAGE:0.5:288:700",
>                 "RRA:MAX:0.5:1:57600",
> #               "RRA:MAX:0.5:6:1440",
> #               "RRA:MAX:0.5:24:360",
> #               "RRA:MAX:0.5:288:700"
>         );
>
> Its in NfSenRRD.pm, I was trying for 157600 but lowered it on most recent
> tests.
>
> Brian
>
>
>
>  On 4/5/06, Peter Haag <ha...@sw...> wrote:
> >
> > -----BEGIN PGP SIGNED MESSAGE-----
> >
> > Hi Brian,
> >
> > - --On March 29, 2006 16:48:39 -0800 Brian Jones < wor...@gm...=
>
> > wrote:
> >
> > | I upgraded to the lastest snapshot (thanks for adding this Peter)
> > because I
> > | wanted the ability to add new sources.
> > | Unfortunately even though I have 10GB or so of flow logs it didn't
> > seen to
> > | processs them in to the RRD.
> > |
> > | I didn't make some changes to NfsenRRD.pm to make the RRAs large (but
> > I've
> > | done this in the past without trouble).
> > |
> > | I'm wondering where I might be going wrong?
> > |
> > | Here's an output on the profile:
> > | #
> > | # Profile live.
> > | #
> > | name    live
> > | tstart  Sat Mar 11 20:45:00 2006
> > | tend    Wed Mar 29 16:40:00 2006
> > | updated Wed Mar 29 16:40:00 2006
> > | filter  <none>
> > | expire  0 hours
> > | size    7.9 GB
> > | maxsize 10.0 GB
> > | sources anaheim_out:burbank_out:amsterdam_out
> > | type    live
> > | locked  0
> > | status  OK
> > |
> > | You can see it starts March 11th, but I'm only seeing data from the
> > time I
> > | did the upgrade.
> > |
> > | My only other thought is I may have changed the collector names at
> > some
> > | point in the process, but I don't think that should impact the old
> > logs?
> >
> > Please describe, what excatly you have done.
> > You must have done something strange as creating a file named
> > 1142138400.rrd is
> > more than odd!
> >
> > Otherwise:
> > 1. Make sure the sources in your nfsen.conf corresponds to your
> > directory names
> >   in profile/live.
> > 2. run ./nfsen reconfig
> > 3. rebuild your profile live: ./nfsen -r live
> >
> > You may do that at any time, while new data is coming in. Profile acces=
s
> > is
> > arbitrated correctly.
> >
> > This should bring back your profile, but anyway I'd be interessted what
> > you really did ...
> >
> >    - Peter
> >
> > |
> > | TIA
> >
> >
> >
> > - --
> > _______ SWITCH - The Swiss Education and Research Network ______
> > Peter Haag,  Security Engineer,  Member of SWITCH CERT
> > PGP fingerprint: D9 31 D5 83 03 95 68 BA  FB 84 CA 94 AB FC 5D D7
> > SWITCH,  Limmatquai 138,  CH-8001 Zurich,  Switzerland
> > E-mail: pet...@sw... Web: http://www.switch.ch/
> > -----BEGIN PGP SIGNATURE-----
> > Version: GnuPG v1.2.4 (Darwin)
> >
> > iQCVAwUBRDObcv5AbZRALNr/AQHJ1QP/Ql4tbXtMKS4/6R/oxO5UKrdrYi+teP5r
> > 4OVg1FTxS1rYe/LjEmM12h0luyz9YpbAtbEPU7Lo/f3/x7Kld6sBqZKFudIwtdGd
> > f/oc42AJRiuAPJPWa2Uh90DYo7+YBv6hqLeM+UeeAMWZ7IABtojZRyE/upHCGLc+
> > XB/sN9VbI8E=3D
> > =3DAdIa
> > -----END PGP SIGNATURE-----
> >
> >
>