Re: [Nfsen-discuss] Nfcapd fails to update graphs: "Can't get statinfo!"

[Peter H. <ha...@sw...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi Giles,

- -------- Original Message  --------
From: "Giles Coochey" <Gi...@Ca...>
To: nfs...@li...
Subject: [Nfsen-discuss] Nfcapd fails to update graphs: "Can't get statinfo!"
Date: Mon Aug 14 2006 17:31:14 GMT+0200 (CEST)

> Hi,
> 
> I've had nfsen-1.2.4 (compiled from Source on a x64 box) running
> smoothly for about a week, then today I noticed that while nfcapd still
> seemed to be happily creating files that the graphs had stopped
> updating.
> 
> Stopping and starting via the init script seems to have fixed things.
> 
> The only clue as to what happened is in my syslog, see the "Can't get
> statinfo!" for the ServerWWW profile, at 5:50am the live profile started
> giving the same error. ServerWWW is a continuous profile with a 35day

nfsen runs the command nfdump -I .. to retrieve statinfo from data files. For any unobvious reason, this
command could not be completed. You may change line 481 in libexec/NfSen.pm and add '$!' so the line looks like:

$Log::ERROR = "$name/$source/nfcapd.$tstamp: Can't get statinfo: $!";

This should give you more information about the reason why the command failed.

Did you change any settings/permissions/users/groups in the meantime? Did you manipulate any files as root? - just possible sources for this error.

I run nfsen-1.2,4 on our production server without any problems since ever. Maybe you can figure why this happened. I'd be interested in that.

	- Peter

> expiry and no max size. It's currently less than 1Gb in size. Live is
> similar 35Gb and is just a few Gig in size. /var is ext3 filesystem with
> less than 2% total utilisation so far.
> 
> It's a new install, and the system isn't scheduled to be doing anything
> other than nagios & nfcapd at that time of day.
> 
> Here is the log excerpt:
> 
> Aug 14 05:35:00 nms /usr/local/bin/nfcapd[6530]: Signal launcher
> Aug 14 05:35:00 nms /usr/local/bin/nfcapd[6530]: Ident: 'router01'
> Flows: 5370, Packets: 68998, Bytes: 35388008, Sequence Errors: 0, Bad
> Packets: 0
> Aug 14 05:35:00 nms /usr/local/bin/nfcapd[6529]: Launcher: Wakeup
> Aug 14 05:35:00 nms /usr/local/bin/nfcapd[6529]: Launcher: run command:
> '/usr/local/bin/nfprofile -q -p /var/nfsen//profiles -s router01 -r
> /var/nfsen//profiles/live/router01/nfcapd.200608140530
> '
> Aug 14 05:35:00 nms /usr/local/bin/nfcapd[6529]: Launcher: child 14362
> terminated: 0
> Aug 14 05:35:03 nms /usr/local/bin/nfcapd[6521]: Signal launcher
> Aug 14 05:35:03 nms /usr/local/bin/nfcapd[6521]: Ident: 'router02'
> Flows: 2550, Packets: 19067, Bytes: 4537263, Sequence Errors: 0, Bad
> Packets: 0
> Aug 14 05:35:03 nms /usr/local/bin/nfcapd[6520]: Launcher: Wakeup
> Aug 14 05:35:03 nms /usr/local/bin/nfcapd[6520]: Launcher: run command:
> '/usr/local/bin/nfprofile -q -p /var/nfsen//profiles -s router02 -r
> /var/nfsen//profiles/live/router02/nfcapd.200608140530
> '
> Aug 14 05:35:03 nms /usr/local/bin/nfcapd[6520]: Launcher: Wakeup
> Aug 14 05:35:03 nms /usr/local/bin/nfcapd[6520]: Launcher: child 14363
> terminated: 0
> Aug 14 05:35:30 nms nfsen[6532]: Run periodic at Mon Aug 14 05:35:00
> 2006
> Aug 14 05:35:30 nms nfsen[6532]: Update profile live
> Aug 14 05:35:34 nms nfsen[6532]: Update profile ServerWWW
> Aug 14 05:35:34 nms nfsen[6532]: ServerWWW/router02/nfcapd.200608140525:
> Can't get statinfo!
> Aug 14 05:35:34 nms nfsen[6532]: ServerWWW/router01/nfcapd.200608140525:
> Can't get statinfo!
> Aug 14 05:35:36 nms nfsen[6532]: End periodic at Mon Aug 14 05:35:00
> 2006
> Aug 14 05:35:36 nms nfsen[6532]: Run expire at Mon Aug 14 05:35:00 2006
> Aug 14 05:35:36 nms nfsen[6532]: Expire profile live
> Aug 14 05:35:36 nms nfsen[6532]: No size limit reached
> Aug 14 05:35:36 nms nfsen[6532]: No time limit reached
> Aug 14 05:35:36 nms nfsen[6532]: Nothing to expire
> Aug 14 05:35:36 nms nfsen[6532]: Expire profile ServerWWW
> Aug 14 05:35:36 nms nfsen[6532]: No size limit reached
> Aug 14 05:35:36 nms nfsen[6532]: No time limit reached
> Aug 14 05:35:36 nms nfsen[6532]: Nothing to expire
> Aug 14 05:35:36 nms nfsen[6532]: End expire at Mon Aug 14 05:35:00 2006
> 
> Any ideas?
> 
> It's a real shame, as the last weeks graphs haven't shown any of the
> issues that I've had with other tools... Until they died this morning
> :-(
> 
> -------------------------------------------------------------------------
> Using Tomcat but need to do more? Need to support web services, security?
> Get stuff done quickly with pre-integrated technology to make your job easier
> Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
> http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
> _______________________________________________
> Nfsen-discuss mailing list
> Nfs...@li...
> https://lists.sourceforge.net/lists/listinfo/nfsen-discuss
> 

- --
_______ SWITCH - The Swiss Education and Research Network ______
Peter Haag,  Security Engineer,  Member of SWITCH CERT
PGP fingerprint: D9 31 D5 83 03 95 68 BA  FB 84 CA 94 AB FC 5D D7
SWITCH,  Limmatquai 138,  CH-8001 Zurich,  Switzerland
E-mail: pet...@sw... Web: http://www.switch.ch/security
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (Darwin)

iQCVAwUBROKz+/5AbZRALNr/AQI4NQP9FAUaNBtFhNF5wJvqFBvGBq2tKxhM4UuV
sJJ1ji8JrVbwGcXpQiNpuOl1Yd3dpD7pVJE8kXSBImtn3a0nWqQgB1rAnOX21rwg
bl/w5xcrPYKxCg/nL7g+uTNn5/i2n5uKVEhpMQnQH6e5tCY79oDZx12B0ASaJK6P
IXxKKL67Sq4=
=0+0i
-----END PGP SIGNATURE-----