Re: [Nfsen-discuss] resetting profile data size

[Peter H. <ha...@sw...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi Ivan,


- -------- Original Message  --------
From: "Ivan A. Beveridge" <iv...@li...>
To: nfsen-discuss ML <nfs...@li...>
Subject: [Nfsen-discuss] resetting profile data size
Date: Wed Jul 19 2006 11:32:14 GMT+0200 (CEST)

> Hi,
> 
> Following yesterday's $PROFILEDATA filesystem failure and consequent

Such incident are always annoying. Hopefully you back up to speed soon.

> data loss I recreated the relevant directories under the $PROFILEDATA
> heirarchy.
> 
> The problem is that the profiles still think they have all the data in
> them (as far as profile size goes in the stats page) .. however the
> profileinfo (in the details page) echoes the true details about the
> start/end times of the profile-data.
> 
> What this means is that, currently, nfsen is reporting the profile-size
> as 891.5GB (real size 386MB), but the start/end times are 10:00-10:15
> today (current time 10:22). This means that it has expired data since
> the PROFILEDATA filesystem has been brought back online (and empty).

The point is, that nfsen keep all this data in profile.dat for speed reason. That's why it still believes it has about 891GB of data. Otherwise nfsen would need to scan the entire filesystem each
5min. Assume you have ext2 fs and several TB of data ... :)

> 
> How do I go about getting nfsen to notice the disk space has changed,
> and is lower than it currently thinks?
> 
> The part caveat to that is that rebuilding the profile has always wiped
> the RRD data for me (and rebuilt it using the nfcapd logs) which means I
> lose a lot of graph data - 4 months in my case.

That's true. Up to current releases, rebuilding a profile means rebuilding the profile from available data and recreating the RRD DBs. This updates all stats in profile.dat, so your profile reflects,
what's on the disk.

> 
> Hacking the profile.dat may be a solution but, if there is a
> better/cleaner way it would be good, as I'll be documenting it for
> others to know.

Well - if you ask for a "clean" way .... but I assume you want to have your problem solved, "hacking" is most probably the better word ...

Without any warranty:
1. To be a kind of save, backup the rrd files in question - one never knows ..
2. in module libexec/NfProfile.pm:
   comment line 804, reading: NfSenRRD::SetupRRD(...
   This line number is valid for snapshot-20060412
   This prevents the setup of new RRD DBs
3. rebuild the profile
   In the next update cycle, you will see massive error messages in the log file, where RRD
   complains about new timeslot is older than most recent timeslot. These are complaining messages only
   and do not really harm.
4. Uncomment line 804 in NfProfile.pm

Note: you do not need to reload NfSen, as profile rebuilding is done by the process you start.

If anythings fails and the profile ends up totally screwed up, you can savely copy back the saved RRD DBs ..

I konw, it's cold comfort, but future releases will have better profile expiring/rebuilding capabilities.

Hope this helps - play up!

	- Peter

P.S. Kids - don't do that at home ...

> 
> For info, I'm using the latest snapshot (that I know of):
> 
> ===================================
> nfsen: snapshot-20060412 $Id: nfsen 55 2006-04-12 08:35:59Z peter $
> 
> nfdump: Version: snapshot-20060413 $LastChangedDate: 2006-04-13 14:11:48
> +0200 (Thu, 13 Apr 2006) $
> $Id: nfdump.c 69 2006-04-13 12:11:48Z peter $
> ===================================
> 
> Cheers
> 
> 
> Ivan

- -------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys -- and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Nfsen-discuss mailing list
Nfs...@li...
https://lists.sourceforge.net/lists/listinfo/nfsen-discuss


- --
_______ SWITCH - The Swiss Education and Research Network ______
Peter Haag,  Security Engineer,  Member of SWITCH CERT
PGP fingerprint: D9 31 D5 83 03 95 68 BA  FB 84 CA 94 AB FC 5D D7
SWITCH,  Limmatquai 138,  CH-8001 Zurich,  Switzerland
E-mail: pet...@sw... Web: http://www.switch.ch/security
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (Darwin)

iQCVAwUBRL4+ef5AbZRALNr/AQLhfAP8CMWfXI4iEtWjzHJ4stRQan6SG48Pl736
nbzqVpESkFi2rtM49uyul6q9qCj1sAEmpQInP8ECVYzpmO0sWVCpxDOCSOkKSRgK
WM38ZjSbl4LnWjW+Cj2kiG0YgkPwrrdlUscTnkkSmMJF8/2dG7DF72JrZN/aKUTZ
0nPKU9yLIRQ=
=DWZh
-----END PGP SIGNATURE-----