Re: [Nfsen-discuss] nfsen flowdata from old sources?

[Peter H. <ha...@sw...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi Ivan,

- -------- Original Message  --------
From: "Ivan A. Beveridge" <iv...@li...>
To: nfsen-discuss ML <nfs...@li...>
Subject: [Nfsen-discuss] nfsen flowdata from old sources?
Date: Fri Jul 07 2006 20:35:43 GMT+0200 (CEST)

> Hi (Peter ;)
> 
> I currently have 10 flow sources configured, and several of them are not
> actually sending data any more. I want to keep the data from the old
> sources until it expires, but I don't think this is possible if I
> deconfigure the sources in nfsen.conf.

If you deconfigure a source, the data can be kept or deleted. But latest nfsen snapshot will no longer show any deconfigured sources.

> 
> Is there a way to keep this old data & have it shown in the graphs (and
> displayed when doing a search in the (net)flow processing section of the
> "detailed" tab ... (and have it expire along with the data from the
> other sources in a profile)?

You can keep the source in your live profile, even the no data will be exported any more. So you can work with the data as used to. The data gets expired along all other sources. Or you may create
another profile and move the data from the sources in question into that profile and rebuild the new profile. Doing that needs work on the cmd line to actually mv the directories into the new profile.
The old sources can then be removed from nfsen.conf. The new profile can be either a history profile ( keeps the data forever ) or a continues profile ( data get expired, is limits are set ).

> 
> The reason that I have this issue is that we've been upgrading/migrating
> switches (I create 1 listener source per switch); most of the old
> switches have now been fully replaced but we still want/need access to
> the old flowdata.
> 
> This would be really useful ... but (from memory) Peter said this kind
> of thing would be redundant because the next version of nfsen would
> allow us to visualise the graphs irrespective of sources (ie you can
> have 1 source and split it into various graphs).

Right. Data from one or more sources can form one or more channels, each channel with its own filter.

> 
> .. so I guess I could be a little more cheeky than normal and say "hey
> peter - how's the next version of nfsen going?" (along with the expected
> "full sflow support would be cool" ;)

Well - I can not give any date so far. Anything new will hopefully be ready for NANOG in October. But I can not promise a full new release. Everything depends on my operational work, along with
holidays and weather conditions :)

	- Peter
> 
> Cheers
> 
> 
> Ivan

Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Nfsen-discuss mailing list
Nfs...@li...
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss


- --
_______ SWITCH - The Swiss Education and Research Network ______
Peter Haag,  Security Engineer,  Member of SWITCH CERT
PGP fingerprint: D9 31 D5 83 03 95 68 BA  FB 84 CA 94 AB FC 5D D7
SWITCH,  Limmatquai 138,  CH-8001 Zurich,  Switzerland
E-mail: pet...@sw... Web: http://www.switch.ch/security
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (Darwin)

iQCVAwUBRLSiG/5AbZRALNr/AQKStgQAmS6bJkBViPpJVAqvyqP6AXPGpbhRAR8r
mz0QIBwjxoNzLOyl+P31x51uaJwf+jny3jA+ZPhCfeQzrjPro6+OttuiU8nPnlCn
C6kvS6+At3N+kAWEqBJDLyMl6vOKhePtqK9BRY02cjCVykmEzSyN4gN1/SxPeejt
BuN8jGs/wMc=
=AnlP
-----END PGP SIGNATURE-----