Top Talkers not displaying for similarly configured FWs

This support forum board is for support questions relating to Nagios Network Analyzer, our network traffic and bandwidth analysis solution.
Locked
nmfshqnetworkteam
Posts: 4
Joined: Mon Sep 27, 2021 9:08 am

Top Talkers not displaying for similarly configured FWs

Post by nmfshqnetworkteam »

Hello,

I have two identical firewalls (Cisco FPR-2130s) which are configured with very similar configs (except the ports) Please assist!

This one works and displays the top-talkers:

Code: Select all

flow-export destination MONITORING x.x.x.110 2000
flow-export template timeout-rate 30
flow-export delay flow-create 1
flow-export active refresh-interval 1
policy-map global_policy 
class class-default
flow-export event-type all destination x.x.x.110
service-policy global_policy global
This one displays the graph at the top, but no top-talkers:

Code: Select all

flow-export destination wan x.x.x.x110 2055
flow-export template timeout-rate 30
flow-export delay flow-create 1
flow-export active refresh-interval 1
policy-map global_policy 
class class-default
flow-export event-type all destination x.x.x.110
service-policy global_policy global
From another post, these questions were asked for a similar issue:

Code: Select all

uname -a
cat /etc/*release
php -v
ps aux | grep nfcap
ls -l /usr/local/nagiosna/var
ls -l /usr/local/nagiosna/var/THEFAILINGSOURCENAME
ls -l /usr/local/nagiosna/var/THEFAILINGSOURCENAME/flows
Here are the answers to these:

Code: Select all

[root@netflow ~]# uname -a
Linux netflow.internalorg.org 3.10.0-1160.45.1.el7.x86_64 #1 SMP Wed Oct 13 17:2                                                                                             0:51 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux
[root@netflow ~]# cat /etc/*release
CentOS Linux release 7.9.2009 (Core)
NAME="CentOS Linux"
VERSION="7 (Core)"
ID="centos"
ID_LIKE="rhel fedora"
VERSION_ID="7"
PRETTY_NAME="CentOS Linux 7 (Core)"
ANSI_COLOR="0;31"
CPE_NAME="cpe:/o:centos:centos:7"
HOME_URL="https://www.centos.org/"
BUG_REPORT_URL="https://bugs.centos.org/"

CENTOS_MANTISBT_PROJECT="CentOS-7"
CENTOS_MANTISBT_PROJECT_VERSION="7"
REDHAT_SUPPORT_PRODUCT="centos"
REDHAT_SUPPORT_PRODUCT_VERSION="7"

CentOS Linux release 7.9.2009 (Core)
CentOS Linux release 7.9.2009 (Core)
[root@netflow ~]# php -v
PHP 5.4.16 (cli) (built: Apr  1 2020 04:07:17)
Copyright (c) 1997-2013 The PHP Group
Zend Engine v2.4.0, Copyright (c) 1998-2013 Zend Technologies
[root@netflow ~]# ps aux | grep nfcap
nna       3621  0.0  0.0  32660  3116 ?        S    Nov13   0:00 /usr/local/bin/                                                                                             nfcapd -I 1 -l /usr/local/nagiosna/var/SSMC3TESTSW/flows -p 2050 -x /usr/local/n                                                                                             agiosna/bin/reap_files.py %d %f %i -P /usr/local/nagiosna/var/SSMC3TESTSW/2050.p                                                                                             id -D -e -w -z -T all
nna       3623  0.0  0.0  11660  1276 ?        S    Nov13   0:04 /usr/local/bin/                                                                                             nfcapd -I 1 -l /usr/local/nagiosna/var/SSMC3TESTSW/flows -p 2050 -x /usr/local/n                                                                                             agiosna/bin/reap_files.py %d %f %i -P /usr/local/nagiosna/var/SSMC3TESTSW/2050.p                                                                                             id -D -e -w -z -T all
nna       3814  0.1  0.0  32660  4216 ?        S    Nov13   5:06 /usr/local/bin/                                                                                             nfcapd -I 2 -l /usr/local/nagiosna/var/ASHBURNLANSTK/flows -p 2005 -x /usr/local                                                                                             /nagiosna/bin/reap_files.py %d %f %i -P /usr/local/nagiosna/var/ASHBURNLANSTK/20                                                                                             05.pid -D -e -w -z -T all
nna       3816  0.0  0.0  11660  1272 ?        S    Nov13   0:04 /usr/local/bin/                                                                                             nfcapd -I 2 -l /usr/local/nagiosna/var/ASHBURNLANSTK/flows -p 2005 -x /usr/local                                                                                             /nagiosna/bin/reap_files.py %d %f %i -P /usr/local/nagiosna/var/ASHBURNLANSTK/20                                                                                             05.pid -D -e -w -z -T all
nna       3971  0.0  0.0  32660  2604 ?        S    Nov13   0:00 /usr/local/bin/                                                                                             nfcapd -I 3 -l /usr/local/nagiosna/var/ASHBURNNEWVPN/flows -p 9002 -x /usr/local                                                                                             /nagiosna/bin/reap_files.py %d %f %i -P /usr/local/nagiosna/var/ASHBURNNEWVPN/90                                                                                             02.pid -D -e -w -z -T all
nna       3973  0.0  0.0  11660  1272 ?        S    Nov13   0:04 /usr/local/bin/                                                                                             nfcapd -I 3 -l /usr/local/nagiosna/var/ASHBURNNEWVPN/flows -p 9002 -x /usr/local                                                                                             /nagiosna/bin/reap_files.py %d %f %i -P /usr/local/nagiosna/var/ASHBURNNEWVPN/90                                                                                             02.pid -D -e -w -z -T all
nna       4250  1.2  0.1  33720  8396 ?        S    Nov13  33:35 /usr/local/bin/                                                                                             nfcapd -I 4 -l /usr/local/nagiosna/var/ASHBURNINETFW1/flows -p 2055 -x /usr/loca                                                                                             l/nagiosna/bin/reap_files.py %d %f %i -P /usr/local/nagiosna/var/ASHBURNINETFW1/                                                                                             2055.pid -D -e -w -z -T all
nna       4252  0.0  0.0  11660  1276 ?        S    Nov13   0:04 /usr/local/bin/                                                                                             nfcapd -I 4 -l /usr/local/nagiosna/var/ASHBURNINETFW1/flows -p 2055 -x /usr/loca                                                                                             l/nagiosna/bin/reap_files.py %d %f %i -P /usr/local/nagiosna/var/ASHBURNINETFW1/                                                                                             2055.pid -D -e -w -z -T all
nna       4521  1.4  0.0  32792  7904 ?        S    Nov13  38:52 /usr/local/bin/                                                                                             nfcapd -I 5 -l /usr/local/nagiosna/var/SEAINETFW/flows -p 2000 -x /usr/local/nag                                                                                             iosna/bin/reap_files.py %d %f %i -P /usr/local/nagiosna/var/SEAINETFW/2000.pid -                                                                                             D -e -w -z -T all
nna       4522  0.0  0.0  11660  1272 ?        S    Nov13   0:04 /usr/local/bin/                                                                                             nfcapd -I 5 -l /usr/local/nagiosna/var/SEAINETFW/flows -p 2000 -x /usr/local/nag                                                                                             iosna/bin/reap_files.py %d %f %i -P /usr/local/nagiosna/var/SEAINETFW/2000.pid -                                                                                             D -e -w -z -T all
nna       4840  0.0  0.0  32660  4204 ?        S    Nov13   1:43 /usr/local/bin/                                                                                             nfcapd -I 6 -l /usr/local/nagiosna/var/ASHBURNWANRTR/flows -p 2053 -x /usr/local                                                                                             /nagiosna/bin/reap_files.py %d %f %i -P /usr/local/nagiosna/var/ASHBURNWANRTR/20                                                                                             53.pid -D -e -w -z -T all
nna       4844  0.0  0.0  11660  1272 ?        S    Nov13   0:03 /usr/local/bin/                                                                                             nfcapd -I 6 -l /usr/local/nagiosna/var/ASHBURNWANRTR/flows -p 2053 -x /usr/local                                                                                             /nagiosna/bin/reap_files.py %d %f %i -P /usr/local/nagiosna/var/ASHBURNWANRTR/20                                                                                             53.pid -D -e -w -z -T all
nna       5281  0.0  0.1  32660  8368 ?        S    Nov13   1:15 /usr/local/bin/                                                                                             nfcapd -I 8 -l /usr/local/nagiosna/var/HQLANF14STK1/flows -p 2054 -x /usr/local/                                                                                             nagiosna/bin/reap_files.py %d %f %i -P /usr/local/nagiosna/var/HQLANF14STK1/2054                                                                                             .pid -D -e -w -z -T all
nna       5283  0.0  0.0  11660  1272 ?        S    Nov13   0:03 /usr/local/bin/                                                                                             nfcapd -I 8 -l /usr/local/nagiosna/var/HQLANF14STK1/flows -p 2054 -x /usr/local/                                                                                             nagiosna/bin/reap_files.py %d %f %i -P /usr/local/nagiosna/var/HQLANF14STK1/2054                                                                                             .pid -D -e -w -z -T all
nna       5719  0.0  0.0  32660  7904 ?        S    Nov13   2:30 /usr/local/bin/                                                                                             nfcapd -I 9 -l /usr/local/nagiosna/var/SEAWANRTR/flows -p 2051 -x /usr/local/nag                                                                                             iosna/bin/reap_files.py %d %f %i -P /usr/local/nagiosna/var/SEAWANRTR/2051.pid -                                                                                             D -e -w -z -T all
nna       5721  0.0  0.0  11660  1268 ?        S    Nov13   0:03 /usr/local/bin/                                                                                             nfcapd -I 9 -l /usr/local/nagiosna/var/SEAWANRTR/flows -p 2051 -x /usr/local/nag                                                                                             iosna/bin/reap_files.py %d %f %i -P /usr/local/nagiosna/var/SEAWANRTR/2051.pid -                                                                                             D -e -w -z -T all
nna       5886  0.1  0.0  32660  7684 ?        S    Nov13   4:16 /usr/local/bin/                                                                                             nfcapd -I 10 -l /usr/local/nagiosna/var/HQSERVERSWITCH/flows -p 2001 -x /usr/loc                                                                                             al/nagiosna/bin/reap_files.py %d %f %i -P /usr/local/nagiosna/var/HQSERVERSWITCH                                                                                             /2001.pid -D -e -w -z -T all
nna       5888  0.0  0.0  11660  1276 ?        S    Nov13   0:04 /usr/local/bin/                                                                                             nfcapd -I 10 -l /usr/local/nagiosna/var/HQSERVERSWITCH/flows -p 2001 -x /usr/loc                                                                                             al/nagiosna/bin/reap_files.py %d %f %i -P /usr/local/nagiosna/var/HQSERVERSWITCH                                                                                             /2001.pid -D -e -w -z -T all
nna       6213  0.0  0.0  32660  2600 ?        S    Nov13   0:00 /usr/local/bin/                                                                                             nfcapd -I 11 -l /usr/local/nagiosna/var/HQ6506VSSMLS/flows -p 2010 -x /usr/local                                                                                             /nagiosna/bin/reap_files.py %d %f %i -P /usr/local/nagiosna/var/HQ6506VSSMLS/201                                                                                             0.pid -D -e -w -z -T all
nna       6215  0.0  0.0  11660  1268 ?        S    Nov13   0:03 /usr/local/bin/                                                                                             nfcapd -I 11 -l /usr/local/nagiosna/var/HQ6506VSSMLS/flows -p 2010 -x /usr/local                                                                                             /nagiosna/bin/reap_files.py %d %f %i -P /usr/local/nagiosna/var/HQ6506VSSMLS/201                                                                                             0.pid -D -e -w -z -T all
nna       6363  0.0  0.0  32660  2620 ?        S    Nov13   0:00 /usr/local/bin/                                                                                             nfcapd -I 12 -l /usr/local/nagiosna/var/SEAAGGSW1/flows -p 2011 -x /usr/local/na                                                                                             giosna/bin/reap_files.py %d %f %i -P /usr/local/nagiosna/var/SEAAGGSW1/2011.pid                                                                                              -D -e -w -z -T all
nna       6369  0.0  0.0  11660  1276 ?        S    Nov13   0:04 /usr/local/bin/                                                                                             nfcapd -I 12 -l /usr/local/nagiosna/var/SEAAGGSW1/flows -p 2011 -x /usr/local/na                                                                                             giosna/bin/reap_files.py %d %f %i -P /usr/local/nagiosna/var/SEAAGGSW1/2011.pid                                                                                              -D -e -w -z -T all
nna       6648  0.0  0.0  32660  7824 ?        S    Nov13   0:34 /usr/local/bin/                                                                                             nfcapd -I 13 -l /usr/local/nagiosna/var/AKC9200KODIAKCORE/flows -p 2076 -x /usr/                                                                                             local/nagiosna/bin/reap_files.py %d %f %i -P /usr/local/nagiosna/var/AKC9200KODI                                                                                             AKCORE/2076.pid -D -e -w -z -T all
nna       6650  0.0  0.0  11660  1272 ?        S    Nov13   0:03 /usr/local/bin/                                                                                             nfcapd -I 13 -l /usr/local/nagiosna/var/AKC9200KODIAKCORE/flows -p 2076 -x /usr/                                                                                             local/nagiosna/bin/reap_files.py %d %f %i -P /usr/local/nagiosna/var/AKC9200KODI                                                                                             AKCORE/2076.pid -D -e -w -z -T all
nna       6907  0.0  0.0  32660  4208 ?        S    Nov13   2:15 /usr/local/bin/                                                                                             nfcapd -I 14 -l /usr/local/nagiosna/var/AKC9500JUNEAUCORE1/flows -p 2081 -x /usr                                                                                             /local/nagiosna/bin/reap_files.py %d %f %i -P /usr/local/nagiosna/var/AKC9500JUN                                                                                             EAUCORE1/2081.pid -D -e -w -z -T all
nna       6908  0.0  0.0  11660  1276 ?        S    Nov13   0:03 /usr/local/bin/                                                                                             nfcapd -I 14 -l /usr/local/nagiosna/var/AKC9500JUNEAUCORE1/flows -p 2081 -x /usr                                                                                             /local/nagiosna/bin/reap_files.py %d %f %i -P /usr/local/nagiosna/var/AKC9500JUN                                                                                             EAUCORE1/2081.pid -D -e -w -z -T all
nna       7334  0.0  0.0  32660  7768 ?        S    Nov13   0:12 /usr/local/bin/                                                                                             nfcapd -I 15 -l /usr/local/nagiosna/var/AKC6807SEATTLE/flows -p 2062 -x /usr/loc                                                                                             al/nagiosna/bin/reap_files.py %d %f %i -P /usr/local/nagiosna/var/AKC6807SEATTLE                                                                                             /2062.pid -D -e -w -z -T all
nna       7335  0.0  0.0  11660  1276 ?        S    Nov13   0:03 /usr/local/bin/                                                                                             nfcapd -I 15 -l /usr/local/nagiosna/var/AKC6807SEATTLE/flows -p 2062 -x /usr/loc                                                                                             al/nagiosna/bin/reap_files.py %d %f %i -P /usr/local/nagiosna/var/AKC6807SEATTLE                                                                                             /2062.pid -D -e -w -z -T all
nna       7746  0.0  0.0  32660  2612 ?        S    Nov13   0:00 /usr/local/bin/                                                                                             nfcapd -I 16 -l /usr/local/nagiosna/var/AFSCDUTCHHARBORASA/flows -p 2090 -x /usr                                                                                             /local/nagiosna/bin/reap_files.py %d %f %i -P /usr/local/nagiosna/var/AFSCDUTCHH                                                                                             ARBORASA/2090.pid -D -e -w -z -T all
nna       7748  0.0  0.0  11396   900 ?        S    Nov13   0:01 /usr/local/bin/                                                                                             nfcapd -I 16 -l /usr/local/nagiosna/var/AFSCDUTCHHARBORASA/flows -p 2090 -x /usr                                                                                             /local/nagiosna/bin/reap_files.py %d %f %i -P /usr/local/nagiosna/var/AFSCDUTCHH                                                                                             ARBORASA/2090.pid -D -e -w -z -T all
nna       8119  0.2  0.0  32660  4220 ?        S    Nov13   5:54 /usr/local/bin/                                                                                             nfcapd -I 17 -l /usr/local/nagiosna/var/HQBkboneSTK/flows -p 2002 -x /usr/local/                                                                                             nagiosna/bin/reap_files.py %d %f %i -P /usr/local/nagiosna/var/HQBkboneSTK/2002.                                                                                             pid -D -e -w -z -T all
nna       8120  0.0  0.0  11660  1256 ?        S    Nov13   0:03 /usr/local/bin/                                                                                             nfcapd -I 17 -l /usr/local/nagiosna/var/HQBkboneSTK/flows -p 2002 -x /usr/local/                                                                                             nagiosna/bin/reap_files.py %d %f %i -P /usr/local/nagiosna/var/HQBkboneSTK/2002.                                                                                             pid -D -e -w -z -T all
root     29538  0.0  0.0 112816   980 pts/0    S+   11:00   0:00 grep --color=au                                                                                             to nfcap
[root@netflow ~]# ls -l /usr/local/nagiosna/var
total 5160
drwsrwxr-t  3 nna  users     4096 Nov 13 13:53 AFSCDUTCHHARBORASA
drwsrwxr-t  3 nna  users     4096 Nov 13 13:53 AKC6807SEATTLE
drwsrwxr-t  3 nna  users     4096 Nov 13 13:52 AKC9200KODIAKCORE
drwsrwxr-t  3 nna  users     4096 Nov 13 13:53 AKC9500JUNEAUCORE1
drwsrwxr-t  3 nna  users     4096 Nov 13 13:52 ASHBURNINETFW1
drwsrwxr-t  3 nna  users     4096 Nov 13 13:52 ASHBURNLANSTK
drwsrwxr-t  3 nna  users     4096 Nov 13 13:52 ASHBURNNEWVPN
drwsrwxr-t  3 nna  users     4096 Nov 13 13:52 ASHBURNWANRTR
-rw-r--r--  1 nna  nnacmd  965098 Nov 15 11:00 backend.log
-rw-r--r--  1 nna  nnacmd 1048546 Nov 14 19:35 backend.log.1
-rw-r--r--  1 nna  nnacmd     321 Nov 12 00:40 backend.log.10
-rw-r--r--  1 nna  nnacmd 1048546 Nov 14 02:50 backend.log.2
-rw-r--r--  1 nna  nnacmd     266 Nov 13 10:10 backend.log.3
-rw-r--r--  1 nna  nnacmd 1048542 Nov 13 10:10 backend.log.4
-rw-r--r--  1 nna  users      328 Nov 12 17:25 backend.log.5
-rw-r--r--  1 nna  nnacmd     157 Nov 12 17:25 backend.log.6
-rw-r--r--  1 nna  nnacmd 1048557 Nov 12 17:25 backend.log.7
-rw-r--r--  1 nna  nnacmd     973 Nov 12 00:40 backend.log.8
-rw-r--r--  1 nna  nnacmd     325 Nov 12 00:40 backend.log.9
-rw-r--r--  1 nna  users        0 Nov 15 11:00 cache.log
drwxr-xr-x  2 root root      4096 Oct 26 19:14 certs
-rw-r--r--. 1 nna  users        2 Nov 15 11:01 cmdsubsys.log
drwsrwxr-t  3 nna  users     4096 Nov 13 13:52 HQ6506VSSMLS
drwsrwxr-t  3 nna  users     4096 Nov 13 13:53 HQBkboneSTK
drwsrwxr-t  3 nna  users     4096 Nov 13 13:52 HQLANF14STK1
drwsrwxr-t  3 nna  users     4096 Nov 13 13:52 HQSERVERSWITCH
-rw-r--r--. 1 root root         4 Mar 16  2021 nna-itype
drwsrwxr-t  3 nna  users     4096 Nov 13 13:52 SEAAGGSW1
drwsrwxr-t  3 nna  users     4096 Nov 13 13:52 SEAINETFW
drwsrwxr-t  3 nna  users     4096 Nov 13 13:52 SEAWANRTR
drwsrwxr-t  3 nna  users     4096 Nov 13 13:52 SSMC3TESTSW
[root@netflow ~]# ls -l /usr/local/nagiosna/var/ASHBURNINETFW1/
total 1312
-rw-r--r-- 1 nna nnacmd       5 Nov 13 13:52 2055.pid
-rw-r--r-- 1 nna users  1255360 Nov 15 11:00 bandwidth.rrd
drwxr-xr-x 2 nna users    77824 Nov 15 11:00 flows
[root@netflow ~]# ls -l /usr/local/nagiosna/var/ASHBURNINETFW1/flows
total 51426900
[...]
-rw-r--r-- 1 nna nnacmd  33053182 Nov 14 06:00 nfcapd.202111140555
-rw-r--r-- 1 nna nnacmd  34731854 Nov 14 06:05 nfcapd.202111140600
-rw-r--r-- 1 nna nnacmd  33392748 Nov 14 06:10 nfcapd.202111140605
-rw-r--r-- 1 nna nnacmd  35187634 Nov 14 06:15 nfcapd.202111140610
-rw-r--r-- 1 nna nnacmd  33728810 Nov 14 06:20 nfcapd.202111140615
-rw-r--r-- 1 nna nnacmd  33025271 Nov 14 06:25 nfcapd.202111140620
-rw-r--r-- 1 nna nnacmd  30999907 Nov 14 06:30 nfcapd.202111140625
-rw-r--r-- 1 nna nnacmd  34861304 Nov 14 06:35 nfcapd.202111140630
-rw-r--r-- 1 nna nnacmd  33421432 Nov 14 06:40 nfcapd.202111140635
-rw-r--r-- 1 nna nnacmd  32782698 Nov 14 06:45 nfcapd.202111140640
-rw-r--r-- 1 nna nnacmd  33913281 Nov 14 06:50 nfcapd.202111140645
-rw-r--r-- 1 nna nnacmd  34611720 Nov 14 06:55 nfcapd.202111140650
-rw-r--r-- 1 nna nnacmd  36395547 Nov 14 07:00 nfcapd.202111140655
-rw-r--r-- 1 nna nnacmd  36048432 Nov 14 07:05 nfcapd.202111140700
-rw-r--r-- 1 nna nnacmd  35988956 Nov 14 07:10 nfcapd.202111140705
-rw-r--r-- 1 nna nnacmd  34297018 Nov 14 07:15 nfcapd.202111140710
-rw-r--r-- 1 nna nnacmd  33692348 Nov 14 07:20 nfcapd.202111140715
-rw-r--r-- 1 nna nnacmd  31896908 Nov 14 07:25 nfcapd.202111140720
-rw-r--r-- 1 nna nnacmd  32001622 Nov 14 07:30 nfcapd.202111140725
-rw-r--r-- 1 nna nnacmd  30473807 Nov 14 07:35 nfcapd.202111140730
-rw-r--r-- 1 nna nnacmd  29736389 Nov 14 07:40 nfcapd.202111140735
-rw-r--r-- 1 nna nnacmd  30722813 Nov 14 07:45 nfcapd.202111140740
-rw-r--r-- 1 nna nnacmd  30306482 Nov 14 07:49 nfcapd.202111140745
-rw-r--r-- 1 nna nnacmd  29766158 Nov 14 07:55 nfcapd.202111140750
-rw-r--r-- 1 nna nnacmd  29966099 Nov 14 08:00 nfcapd.202111140755
-rw-r--r-- 1 nna nnacmd  31810035 Nov 14 08:05 nfcapd.202111140800
-rw-r--r-- 1 nna nnacmd  29591635 Nov 14 08:10 nfcapd.202111140805
-rw-r--r-- 1 nna nnacmd  29130544 Nov 14 08:15 nfcapd.202111140810
-rw-r--r-- 1 nna nnacmd  29141011 Nov 14 08:20 nfcapd.202111140815
-rw-r--r-- 1 nna nnacmd  29347510 Nov 14 08:25 nfcapd.202111140820
-rw-r--r-- 1 nna nnacmd  29063644 Nov 14 08:29 nfcapd.202111140825
-rw-r--r-- 1 nna nnacmd  28878769 Nov 14 08:35 nfcapd.202111140830
-rw-r--r-- 1 nna nnacmd  30418752 Nov 14 08:40 nfcapd.202111140835
-rw-r--r-- 1 nna nnacmd  28947823 Nov 14 08:45 nfcapd.202111140840
-rw-r--r-- 1 nna nnacmd  28039026 Nov 14 08:50 nfcapd.202111140845
-rw-r--r-- 1 nna nnacmd  30010169 Nov 14 08:55 nfcapd.202111140850
-rw-r--r-- 1 nna nnacmd  30724703 Nov 14 09:00 nfcapd.202111140855
-rw-r--r-- 1 nna nnacmd  31680442 Nov 14 09:05 nfcapd.202111140900
-rw-r--r-- 1 nna nnacmd  30193970 Nov 14 09:10 nfcapd.202111140905
-rw-r--r-- 1 nna nnacmd  30501968 Nov 14 09:15 nfcapd.202111140910
-rw-r--r-- 1 nna nnacmd  29964659 Nov 14 09:20 nfcapd.202111140915
-rw-r--r-- 1 nna nnacmd  30803964 Nov 14 09:25 nfcapd.202111140920
-rw-r--r-- 1 nna nnacmd  30080381 Nov 14 09:30 nfcapd.202111140925
-rw-r--r-- 1 nna nnacmd  30683159 Nov 14 09:35 nfcapd.202111140930
-rw-r--r-- 1 nna nnacmd  31118173 Nov 14 09:40 nfcapd.202111140935
-rw-r--r-- 1 nna nnacmd  30413820 Nov 14 09:45 nfcapd.202111140940
-rw-r--r-- 1 nna nnacmd  30824112 Nov 14 09:50 nfcapd.202111140945
-rw-r--r-- 1 nna nnacmd  30483350 Nov 14 09:55 nfcapd.202111140950
-rw-r--r-- 1 nna nnacmd  29780169 Nov 14 10:00 nfcapd.202111140955
-rw-r--r-- 1 nna nnacmd  30779173 Nov 14 10:05 nfcapd.202111141000
-rw-r--r-- 1 nna nnacmd  31672639 Nov 14 10:10 nfcapd.202111141005
-rw-r--r-- 1 nna nnacmd  30327522 Nov 14 10:15 nfcapd.202111141010
-rw-r--r-- 1 nna nnacmd  31332932 Nov 14 10:20 nfcapd.202111141015
-rw-r--r-- 1 nna nnacmd  31300781 Nov 14 10:25 nfcapd.202111141020
-rw-r--r-- 1 nna nnacmd  32341672 Nov 14 10:30 nfcapd.202111141025
-rw-r--r-- 1 nna nnacmd  30065247 Nov 14 10:35 nfcapd.202111141030
-rw-r--r-- 1 nna nnacmd  30745700 Nov 14 10:40 nfcapd.202111141035
-rw-r--r-- 1 nna nnacmd  29927549 Nov 14 10:45 nfcapd.202111141040
-rw-r--r-- 1 nna nnacmd  29046031 Nov 14 10:50 nfcapd.202111141045
-rw-r--r-- 1 nna nnacmd  30533703 Nov 14 10:55 nfcapd.202111141050
-rw-r--r-- 1 nna nnacmd  29189510 Nov 14 11:00 nfcapd.202111141055
-rw-r--r-- 1 nna nnacmd  38040797 Nov 14 11:05 nfcapd.202111141100
-rw-r--r-- 1 nna nnacmd  32133899 Nov 14 11:10 nfcapd.202111141105
-rw-r--r-- 1 nna nnacmd  32782484 Nov 14 11:15 nfcapd.202111141110
-rw-r--r-- 1 nna nnacmd  29588186 Nov 14 11:20 nfcapd.202111141115
-rw-r--r-- 1 nna nnacmd  31899321 Nov 14 11:25 nfcapd.202111141120
-rw-r--r-- 1 nna nnacmd  31872128 Nov 14 11:30 nfcapd.202111141125
-rw-r--r-- 1 nna nnacmd  29948265 Nov 14 11:35 nfcapd.202111141130
-rw-r--r-- 1 nna nnacmd  30033292 Nov 14 11:40 nfcapd.202111141135
-rw-r--r-- 1 nna nnacmd  29946480 Nov 14 11:45 nfcapd.202111141140
-rw-r--r-- 1 nna nnacmd  30369155 Nov 14 11:50 nfcapd.202111141145
-rw-r--r-- 1 nna nnacmd  31898556 Nov 14 11:55 nfcapd.202111141150
-rw-r--r-- 1 nna nnacmd  31006448 Nov 14 12:00 nfcapd.202111141155
-rw-r--r-- 1 nna nnacmd  31184372 Nov 14 12:05 nfcapd.202111141200
-rw-r--r-- 1 nna nnacmd  30131402 Nov 14 12:10 nfcapd.202111141205
-rw-r--r-- 1 nna nnacmd  30406810 Nov 14 12:15 nfcapd.202111141210
-rw-r--r-- 1 nna nnacmd  30105887 Nov 14 12:20 nfcapd.202111141215
-rw-r--r-- 1 nna nnacmd  29788360 Nov 14 12:25 nfcapd.202111141220
-rw-r--r-- 1 nna nnacmd  29758561 Nov 14 12:30 nfcapd.202111141225
-rw-r--r-- 1 nna nnacmd  29964886 Nov 14 12:35 nfcapd.202111141230
-rw-r--r-- 1 nna nnacmd  29490837 Nov 14 12:40 nfcapd.202111141235
-rw-r--r-- 1 nna nnacmd  30085021 Nov 14 12:45 nfcapd.202111141240
-rw-r--r-- 1 nna nnacmd  30520801 Nov 14 12:50 nfcapd.202111141245
-rw-r--r-- 1 nna nnacmd  30055886 Nov 14 12:55 nfcapd.202111141250
-rw-r--r-- 1 nna nnacmd  30011663 Nov 14 13:00 nfcapd.202111141255
-rw-r--r-- 1 nna nnacmd  31916829 Nov 14 13:05 nfcapd.202111141300
-rw-r--r-- 1 nna nnacmd  30638726 Nov 14 13:10 nfcapd.202111141305
-rw-r--r-- 1 nna nnacmd  30310720 Nov 14 13:15 nfcapd.202111141310
-rw-r--r-- 1 nna nnacmd  30038905 Nov 14 13:20 nfcapd.202111141315
-rw-r--r-- 1 nna nnacmd  30148275 Nov 14 13:25 nfcapd.202111141320
-rw-r--r-- 1 nna nnacmd  30001787 Nov 14 13:30 nfcapd.202111141325
-rw-r--r-- 1 nna nnacmd  30813475 Nov 14 13:35 nfcapd.202111141330
-rw-r--r-- 1 nna nnacmd  31340837 Nov 14 13:40 nfcapd.202111141335
-rw-r--r-- 1 nna nnacmd  31735621 Nov 14 13:45 nfcapd.202111141340
-rw-r--r-- 1 nna nnacmd  31130074 Nov 14 13:50 nfcapd.202111141345
-rw-r--r-- 1 nna nnacmd  30771250 Nov 14 13:55 nfcapd.202111141350
-rw-r--r-- 1 nna nnacmd  30674903 Nov 14 14:00 nfcapd.202111141355
-rw-r--r-- 1 nna nnacmd  30332534 Nov 14 14:05 nfcapd.202111141400
-rw-r--r-- 1 nna nnacmd  30065867 Nov 14 14:10 nfcapd.202111141405
-rw-r--r-- 1 nna nnacmd  30362222 Nov 14 14:15 nfcapd.202111141410
-rw-r--r-- 1 nna nnacmd  31379200 Nov 14 14:20 nfcapd.202111141415
-rw-r--r-- 1 nna nnacmd  31707618 Nov 14 14:25 nfcapd.202111141420
-rw-r--r-- 1 nna nnacmd  31966887 Nov 14 14:30 nfcapd.202111141425
-rw-r--r-- 1 nna nnacmd  31608381 Nov 14 14:35 nfcapd.202111141430
-rw-r--r-- 1 nna nnacmd  30339181 Nov 14 14:40 nfcapd.202111141435
-rw-r--r-- 1 nna nnacmd  30744304 Nov 14 14:45 nfcapd.202111141440
-rw-r--r-- 1 nna nnacmd  30874337 Nov 14 14:50 nfcapd.202111141445
-rw-r--r-- 1 nna nnacmd  30621447 Nov 14 14:55 nfcapd.202111141450
-rw-r--r-- 1 nna nnacmd  30041284 Nov 14 15:00 nfcapd.202111141455
-rw-r--r-- 1 nna nnacmd  30527268 Nov 14 15:05 nfcapd.202111141500
-rw-r--r-- 1 nna nnacmd  30567219 Nov 14 15:10 nfcapd.202111141505
-rw-r--r-- 1 nna nnacmd  32220937 Nov 14 15:15 nfcapd.202111141510
-rw-r--r-- 1 nna nnacmd  30482764 Nov 14 15:20 nfcapd.202111141515
-rw-r--r-- 1 nna nnacmd  31011355 Nov 14 15:25 nfcapd.202111141520
-rw-r--r-- 1 nna nnacmd  31084733 Nov 14 15:30 nfcapd.202111141525
-rw-r--r-- 1 nna nnacmd  29917878 Nov 14 15:35 nfcapd.202111141530
-rw-r--r-- 1 nna nnacmd  30622825 Nov 14 15:40 nfcapd.202111141535
-rw-r--r-- 1 nna nnacmd  31029098 Nov 14 15:45 nfcapd.202111141540
-rw-r--r-- 1 nna nnacmd  29698932 Nov 14 15:50 nfcapd.202111141545
-rw-r--r-- 1 nna nnacmd  30461523 Nov 14 15:55 nfcapd.202111141550
-rw-r--r-- 1 nna nnacmd  30451746 Nov 14 16:00 nfcapd.202111141555
-rw-r--r-- 1 nna nnacmd  30714491 Nov 14 16:05 nfcapd.202111141600
-rw-r--r-- 1 nna nnacmd  30609835 Nov 14 16:10 nfcapd.202111141605
-rw-r--r-- 1 nna nnacmd  31005604 Nov 14 16:15 nfcapd.202111141610
-rw-r--r-- 1 nna nnacmd  30472620 Nov 14 16:20 nfcapd.202111141615
-rw-r--r-- 1 nna nnacmd  31392843 Nov 14 16:25 nfcapd.202111141620
-rw-r--r-- 1 nna nnacmd  31102410 Nov 14 16:30 nfcapd.202111141625
-rw-r--r-- 1 nna nnacmd  30980409 Nov 14 16:35 nfcapd.202111141630
-rw-r--r-- 1 nna nnacmd  31868955 Nov 14 16:40 nfcapd.202111141635
-rw-r--r-- 1 nna nnacmd  30628779 Nov 14 16:45 nfcapd.202111141640
-rw-r--r-- 1 nna nnacmd  30577472 Nov 14 16:50 nfcapd.202111141645
-rw-r--r-- 1 nna nnacmd  30763042 Nov 14 16:55 nfcapd.202111141650
-rw-r--r-- 1 nna nnacmd  30229144 Nov 14 17:00 nfcapd.202111141655
-rw-r--r-- 1 nna nnacmd  31603114 Nov 14 17:05 nfcapd.202111141700
-rw-r--r-- 1 nna nnacmd  31021695 Nov 14 17:10 nfcapd.202111141705
-rw-r--r-- 1 nna nnacmd  31108861 Nov 14 17:15 nfcapd.202111141710
-rw-r--r-- 1 nna nnacmd  32261410 Nov 14 17:20 nfcapd.202111141715
-rw-r--r-- 1 nna nnacmd  31971504 Nov 14 17:25 nfcapd.202111141720
-rw-r--r-- 1 nna nnacmd  31282111 Nov 14 17:30 nfcapd.202111141725
-rw-r--r-- 1 nna nnacmd  32215199 Nov 14 17:35 nfcapd.202111141730
-rw-r--r-- 1 nna nnacmd  30830875 Nov 14 17:40 nfcapd.202111141735
-rw-r--r-- 1 nna nnacmd  30462510 Nov 14 17:45 nfcapd.202111141740
-rw-r--r-- 1 nna nnacmd  31528824 Nov 14 17:50 nfcapd.202111141745
-rw-r--r-- 1 nna nnacmd  30746322 Nov 14 17:55 nfcapd.202111141750
-rw-r--r-- 1 nna nnacmd  31440920 Nov 14 18:00 nfcapd.202111141755
-rw-r--r-- 1 nna nnacmd  31830306 Nov 14 18:05 nfcapd.202111141800
-rw-r--r-- 1 nna nnacmd  31223852 Nov 14 18:10 nfcapd.202111141805
-rw-r--r-- 1 nna nnacmd  30914126 Nov 14 18:15 nfcapd.202111141810
-rw-r--r-- 1 nna nnacmd  31311026 Nov 14 18:20 nfcapd.202111141815
-rw-r--r-- 1 nna nnacmd  31753374 Nov 14 18:25 nfcapd.202111141820
-rw-r--r-- 1 nna nnacmd  30145019 Nov 14 18:30 nfcapd.202111141825
-rw-r--r-- 1 nna nnacmd  31587015 Nov 14 18:35 nfcapd.202111141830
-rw-r--r-- 1 nna nnacmd  31009187 Nov 14 18:40 nfcapd.202111141835
-rw-r--r-- 1 nna nnacmd  30661327 Nov 14 18:45 nfcapd.202111141840
-rw-r--r-- 1 nna nnacmd  32356972 Nov 14 18:50 nfcapd.202111141845
-rw-r--r-- 1 nna nnacmd  30204556 Nov 14 18:55 nfcapd.202111141850
-rw-r--r-- 1 nna nnacmd  30411922 Nov 14 19:00 nfcapd.202111141855
-rw-r--r-- 1 nna nnacmd  32075833 Nov 14 19:05 nfcapd.202111141900
-rw-r--r-- 1 nna nnacmd  31442906 Nov 14 19:10 nfcapd.202111141905
-rw-r--r-- 1 nna nnacmd  31090503 Nov 14 19:15 nfcapd.202111141910
-rw-r--r-- 1 nna nnacmd  30801490 Nov 14 19:20 nfcapd.202111141915
-rw-r--r-- 1 nna nnacmd  31125389 Nov 14 19:25 nfcapd.202111141920
-rw-r--r-- 1 nna nnacmd  30729438 Nov 14 19:30 nfcapd.202111141925
-rw-r--r-- 1 nna nnacmd  32199659 Nov 14 19:35 nfcapd.202111141930
-rw-r--r-- 1 nna nnacmd  30729945 Nov 14 19:40 nfcapd.202111141935
-rw-r--r-- 1 nna nnacmd  30366909 Nov 14 19:45 nfcapd.202111141940
-rw-r--r-- 1 nna nnacmd  29290509 Nov 14 19:50 nfcapd.202111141945
-rw-r--r-- 1 nna nnacmd  30863409 Nov 14 19:55 nfcapd.202111141950
-rw-r--r-- 1 nna nnacmd  31795465 Nov 14 20:00 nfcapd.202111141955
-rw-r--r-- 1 nna nnacmd  31230769 Nov 14 20:05 nfcapd.202111142000
-rw-r--r-- 1 nna nnacmd  31249524 Nov 14 20:10 nfcapd.202111142005
-rw-r--r-- 1 nna nnacmd  31153429 Nov 14 20:15 nfcapd.202111142010
-rw-r--r-- 1 nna nnacmd  30010865 Nov 14 20:20 nfcapd.202111142015
-rw-r--r-- 1 nna nnacmd  31213597 Nov 14 20:25 nfcapd.202111142020
-rw-r--r-- 1 nna nnacmd  29997077 Nov 14 20:30 nfcapd.202111142025
-rw-r--r-- 1 nna nnacmd  31176873 Nov 14 20:35 nfcapd.202111142030
-rw-r--r-- 1 nna nnacmd  32056810 Nov 14 20:40 nfcapd.202111142035
-rw-r--r-- 1 nna nnacmd  30826040 Nov 14 20:45 nfcapd.202111142040
-rw-r--r-- 1 nna nnacmd  31572245 Nov 14 20:50 nfcapd.202111142045
-rw-r--r-- 1 nna nnacmd  30445259 Nov 14 20:55 nfcapd.202111142050
-rw-r--r-- 1 nna nnacmd  30422436 Nov 14 21:00 nfcapd.202111142055
-rw-r--r-- 1 nna nnacmd  30829810 Nov 14 21:05 nfcapd.202111142100
-rw-r--r-- 1 nna nnacmd  31720033 Nov 14 21:10 nfcapd.202111142105
-rw-r--r-- 1 nna nnacmd  31049355 Nov 14 21:15 nfcapd.202111142110
-rw-r--r-- 1 nna nnacmd  31000091 Nov 14 21:20 nfcapd.202111142115
-rw-r--r-- 1 nna nnacmd  31318683 Nov 14 21:25 nfcapd.202111142120
-rw-r--r-- 1 nna nnacmd  30746431 Nov 14 21:30 nfcapd.202111142125
-rw-r--r-- 1 nna nnacmd  31410461 Nov 14 21:35 nfcapd.202111142130
-rw-r--r-- 1 nna nnacmd  30203197 Nov 14 21:40 nfcapd.202111142135
-rw-r--r-- 1 nna nnacmd  30867489 Nov 14 21:45 nfcapd.202111142140
-rw-r--r-- 1 nna nnacmd  31189176 Nov 14 21:50 nfcapd.202111142145
-rw-r--r-- 1 nna nnacmd  30834071 Nov 14 21:55 nfcapd.202111142150
-rw-r--r-- 1 nna nnacmd  29763971 Nov 14 22:00 nfcapd.202111142155
-rw-r--r-- 1 nna nnacmd  32494616 Nov 14 22:05 nfcapd.202111142200
-rw-r--r-- 1 nna nnacmd  32964110 Nov 14 22:10 nfcapd.202111142205
-rw-r--r-- 1 nna nnacmd  33164785 Nov 14 22:15 nfcapd.202111142210
-rw-r--r-- 1 nna nnacmd  32017853 Nov 14 22:20 nfcapd.202111142215
-rw-r--r-- 1 nna nnacmd  33766340 Nov 14 22:25 nfcapd.202111142220
-rw-r--r-- 1 nna nnacmd  33113237 Nov 14 22:30 nfcapd.202111142225
-rw-r--r-- 1 nna nnacmd  33255446 Nov 14 22:35 nfcapd.202111142230
-rw-r--r-- 1 nna nnacmd  32450990 Nov 14 22:40 nfcapd.202111142235
-rw-r--r-- 1 nna nnacmd  33230136 Nov 14 22:45 nfcapd.202111142240
-rw-r--r-- 1 nna nnacmd  31815595 Nov 14 22:50 nfcapd.202111142245
-rw-r--r-- 1 nna nnacmd  32653995 Nov 14 22:55 nfcapd.202111142250
-rw-r--r-- 1 nna nnacmd  33181172 Nov 14 23:00 nfcapd.202111142255
-rw-r--r-- 1 nna nnacmd  33767357 Nov 14 23:05 nfcapd.202111142300
-rw-r--r-- 1 nna nnacmd  32982923 Nov 14 23:10 nfcapd.202111142305
-rw-r--r-- 1 nna nnacmd  34391558 Nov 14 23:15 nfcapd.202111142310
-rw-r--r-- 1 nna nnacmd  32265872 Nov 14 23:20 nfcapd.202111142315
-rw-r--r-- 1 nna nnacmd  33238460 Nov 14 23:25 nfcapd.202111142320
-rw-r--r-- 1 nna nnacmd  34145898 Nov 14 23:30 nfcapd.202111142325
-rw-r--r-- 1 nna nnacmd  33245047 Nov 14 23:35 nfcapd.202111142330
-rw-r--r-- 1 nna nnacmd  33228127 Nov 14 23:40 nfcapd.202111142335
-rw-r--r-- 1 nna nnacmd  35829997 Nov 14 23:45 nfcapd.202111142340
-rw-r--r-- 1 nna nnacmd  32358276 Nov 14 23:50 nfcapd.202111142345
-rw-r--r-- 1 nna nnacmd  33275510 Nov 14 23:55 nfcapd.202111142350
-rw-r--r-- 1 nna nnacmd  33820115 Nov 15 00:00 nfcapd.202111142355
-rw-r--r-- 1 nna nnacmd  34334136 Nov 15 00:05 nfcapd.202111150000
-rw-r--r-- 1 nna nnacmd  32907250 Nov 15 00:10 nfcapd.202111150005
-rw-r--r-- 1 nna nnacmd  34193504 Nov 15 00:15 nfcapd.202111150010
-rw-r--r-- 1 nna nnacmd  33818009 Nov 15 00:20 nfcapd.202111150015
-rw-r--r-- 1 nna nnacmd  34071833 Nov 15 00:25 nfcapd.202111150020
-rw-r--r-- 1 nna nnacmd  33089892 Nov 15 00:30 nfcapd.202111150025
-rw-r--r-- 1 nna nnacmd  32910841 Nov 15 00:35 nfcapd.202111150030
-rw-r--r-- 1 nna nnacmd  33505988 Nov 15 00:40 nfcapd.202111150035
-rw-r--r-- 1 nna nnacmd  33193020 Nov 15 00:45 nfcapd.202111150040
-rw-r--r-- 1 nna nnacmd  32052048 Nov 15 00:50 nfcapd.202111150045
-rw-r--r-- 1 nna nnacmd  31557303 Nov 15 00:55 nfcapd.202111150050
-rw-r--r-- 1 nna nnacmd  31085222 Nov 15 01:00 nfcapd.202111150055
-rw-r--r-- 1 nna nnacmd  31777905 Nov 15 01:05 nfcapd.202111150100
-rw-r--r-- 1 nna nnacmd  32341971 Nov 15 01:10 nfcapd.202111150105
-rw-r--r-- 1 nna nnacmd  31581404 Nov 15 01:15 nfcapd.202111150110
-rw-r--r-- 1 nna nnacmd  33719637 Nov 15 01:20 nfcapd.202111150115
-rw-r--r-- 1 nna nnacmd  34637422 Nov 15 01:25 nfcapd.202111150120
-rw-r--r-- 1 nna nnacmd  33210156 Nov 15 01:30 nfcapd.202111150125
-rw-r--r-- 1 nna nnacmd  33654762 Nov 15 01:35 nfcapd.202111150130
-rw-r--r-- 1 nna nnacmd  33664558 Nov 15 01:40 nfcapd.202111150135
-rw-r--r-- 1 nna nnacmd  34244335 Nov 15 01:45 nfcapd.202111150140
-rw-r--r-- 1 nna nnacmd  33635216 Nov 15 01:50 nfcapd.202111150145
-rw-r--r-- 1 nna nnacmd  34320956 Nov 15 01:55 nfcapd.202111150150
-rw-r--r-- 1 nna nnacmd  34257121 Nov 15 02:00 nfcapd.202111150155
-rw-r--r-- 1 nna nnacmd  33609053 Nov 15 02:05 nfcapd.202111150200
-rw-r--r-- 1 nna nnacmd  33213251 Nov 15 02:10 nfcapd.202111150205
-rw-r--r-- 1 nna nnacmd  33909412 Nov 15 02:15 nfcapd.202111150210
-rw-r--r-- 1 nna nnacmd  34212469 Nov 15 02:20 nfcapd.202111150215
-rw-r--r-- 1 nna nnacmd  34108422 Nov 15 02:25 nfcapd.202111150220
-rw-r--r-- 1 nna nnacmd  33886928 Nov 15 02:30 nfcapd.202111150225
-rw-r--r-- 1 nna nnacmd  34961156 Nov 15 02:35 nfcapd.202111150230
-rw-r--r-- 1 nna nnacmd  35307789 Nov 15 02:40 nfcapd.202111150235
-rw-r--r-- 1 nna nnacmd  33185398 Nov 15 02:45 nfcapd.202111150240
-rw-r--r-- 1 nna nnacmd  33863817 Nov 15 02:50 nfcapd.202111150245
-rw-r--r-- 1 nna nnacmd  34400925 Nov 15 02:55 nfcapd.202111150250
-rw-r--r-- 1 nna nnacmd  33893631 Nov 15 03:00 nfcapd.202111150255
-rw-r--r-- 1 nna nnacmd  34130163 Nov 15 03:05 nfcapd.202111150300
-rw-r--r-- 1 nna nnacmd  33869830 Nov 15 03:10 nfcapd.202111150305
-rw-r--r-- 1 nna nnacmd  35093908 Nov 15 03:15 nfcapd.202111150310
-rw-r--r-- 1 nna nnacmd  24097516 Nov 15 03:20 nfcapd.202111150315
-rw-r--r-- 1 nna nnacmd  24621804 Nov 15 03:25 nfcapd.202111150320
-rw-r--r-- 1 nna nnacmd  26003550 Nov 15 03:30 nfcapd.202111150325
-rw-r--r-- 1 nna nnacmd  26649457 Nov 15 03:35 nfcapd.202111150330
-rw-r--r-- 1 nna nnacmd  27512723 Nov 15 03:40 nfcapd.202111150335
-rw-r--r-- 1 nna nnacmd  25626167 Nov 15 03:45 nfcapd.202111150340
-rw-r--r-- 1 nna nnacmd  27532855 Nov 15 03:50 nfcapd.202111150345
-rw-r--r-- 1 nna nnacmd  26469827 Nov 15 03:55 nfcapd.202111150350
-rw-r--r-- 1 nna nnacmd  26740655 Nov 15 04:00 nfcapd.202111150355
-rw-r--r-- 1 nna nnacmd  27235520 Nov 15 04:05 nfcapd.202111150400
-rw-r--r-- 1 nna nnacmd  25421238 Nov 15 04:10 nfcapd.202111150405
-rw-r--r-- 1 nna nnacmd  24133279 Nov 15 04:15 nfcapd.202111150410
-rw-r--r-- 1 nna nnacmd  25668398 Nov 15 04:20 nfcapd.202111150415
-rw-r--r-- 1 nna nnacmd  25753758 Nov 15 04:25 nfcapd.202111150420
-rw-r--r-- 1 nna nnacmd  25107422 Nov 15 04:30 nfcapd.202111150425
-rw-r--r-- 1 nna nnacmd  25903399 Nov 15 04:35 nfcapd.202111150430
-rw-r--r-- 1 nna nnacmd  26288186 Nov 15 04:40 nfcapd.202111150435
-rw-r--r-- 1 nna nnacmd  23908093 Nov 15 04:45 nfcapd.202111150440
-rw-r--r-- 1 nna nnacmd  24551608 Nov 15 04:50 nfcapd.202111150445
-rw-r--r-- 1 nna nnacmd  24111500 Nov 15 04:55 nfcapd.202111150450
-rw-r--r-- 1 nna nnacmd  22947739 Nov 15 05:00 nfcapd.202111150455
-rw-r--r-- 1 nna nnacmd  25974240 Nov 15 05:05 nfcapd.202111150500
-rw-r--r-- 1 nna nnacmd  24822541 Nov 15 05:10 nfcapd.202111150505
-rw-r--r-- 1 nna nnacmd  25778726 Nov 15 05:15 nfcapd.202111150510
-rw-r--r-- 1 nna nnacmd  25499316 Nov 15 05:20 nfcapd.202111150515
-rw-r--r-- 1 nna nnacmd 132102997 Nov 15 05:25 nfcapd.202111150520
-rw-r--r-- 1 nna nnacmd 161468071 Nov 15 05:30 nfcapd.202111150525
-rw-r--r-- 1 nna nnacmd  26183462 Nov 15 05:35 nfcapd.202111150530
-rw-r--r-- 1 nna nnacmd  24051452 Nov 15 05:40 nfcapd.202111150535
-rw-r--r-- 1 nna nnacmd  25614257 Nov 15 05:45 nfcapd.202111150540
-rw-r--r-- 1 nna nnacmd  24498729 Nov 15 05:50 nfcapd.202111150545
-rw-r--r-- 1 nna nnacmd  24423925 Nov 15 05:55 nfcapd.202111150550
-rw-r--r-- 1 nna nnacmd  24470685 Nov 15 06:00 nfcapd.202111150555
-rw-r--r-- 1 nna nnacmd  25128261 Nov 15 06:05 nfcapd.202111150600
-rw-r--r-- 1 nna nnacmd  25068219 Nov 15 06:10 nfcapd.202111150605
-rw-r--r-- 1 nna nnacmd  25447962 Nov 15 06:15 nfcapd.202111150610
-rw-r--r-- 1 nna nnacmd  24941770 Nov 15 06:20 nfcapd.202111150615
-rw-r--r-- 1 nna nnacmd  24596720 Nov 15 06:25 nfcapd.202111150620
-rw-r--r-- 1 nna nnacmd  23057763 Nov 15 06:30 nfcapd.202111150625
-rw-r--r-- 1 nna nnacmd  24170900 Nov 15 06:35 nfcapd.202111150630
-rw-r--r-- 1 nna nnacmd  25271376 Nov 15 06:40 nfcapd.202111150635
-rw-r--r-- 1 nna nnacmd  23500008 Nov 15 06:45 nfcapd.202111150640
-rw-r--r-- 1 nna nnacmd  24802144 Nov 15 06:50 nfcapd.202111150645
-rw-r--r-- 1 nna nnacmd  24761404 Nov 15 06:55 nfcapd.202111150650
-rw-r--r-- 1 nna nnacmd  24665226 Nov 15 07:00 nfcapd.202111150655
-rw-r--r-- 1 nna nnacmd  28874384 Nov 15 07:05 nfcapd.202111150700
-rw-r--r-- 1 nna nnacmd  28600797 Nov 15 07:10 nfcapd.202111150705
-rw-r--r-- 1 nna nnacmd  26865688 Nov 15 07:15 nfcapd.202111150710
-rw-r--r-- 1 nna nnacmd  25758602 Nov 15 07:20 nfcapd.202111150715
-rw-r--r-- 1 nna nnacmd  22967253 Nov 15 07:25 nfcapd.202111150720
-rw-r--r-- 1 nna nnacmd  22634551 Nov 15 07:30 nfcapd.202111150725
-rw-r--r-- 1 nna nnacmd  26769711 Nov 15 07:35 nfcapd.202111150730
-rw-r--r-- 1 nna nnacmd  25347432 Nov 15 07:40 nfcapd.202111150735
-rw-r--r-- 1 nna nnacmd  24251805 Nov 15 07:45 nfcapd.202111150740
-rw-r--r-- 1 nna nnacmd  24245036 Nov 15 07:50 nfcapd.202111150745
-rw-r--r-- 1 nna nnacmd  24856236 Nov 15 07:55 nfcapd.202111150750
-rw-r--r-- 1 nna nnacmd  23246462 Nov 15 08:00 nfcapd.202111150755
-rw-r--r-- 1 nna nnacmd  26303511 Nov 15 08:05 nfcapd.202111150800
-rw-r--r-- 1 nna nnacmd  26752159 Nov 15 08:10 nfcapd.202111150805
-rw-r--r-- 1 nna nnacmd  24349343 Nov 15 08:15 nfcapd.202111150810
-rw-r--r-- 1 nna nnacmd  26200822 Nov 15 08:20 nfcapd.202111150815
-rw-r--r-- 1 nna nnacmd  24291092 Nov 15 08:25 nfcapd.202111150820
-rw-r--r-- 1 nna nnacmd  22661008 Nov 15 08:30 nfcapd.202111150825
-rw-r--r-- 1 nna nnacmd  22177029 Nov 15 08:35 nfcapd.202111150830
-rw-r--r-- 1 nna nnacmd  22053827 Nov 15 08:40 nfcapd.202111150835
-rw-r--r-- 1 nna nnacmd  21012591 Nov 15 08:45 nfcapd.202111150840
-rw-r--r-- 1 nna nnacmd  20857171 Nov 15 08:50 nfcapd.202111150845
-rw-r--r-- 1 nna nnacmd  21403992 Nov 15 08:55 nfcapd.202111150850
-rw-r--r-- 1 nna nnacmd  21383195 Nov 15 09:00 nfcapd.202111150855
-rw-r--r-- 1 nna nnacmd  21620033 Nov 15 09:05 nfcapd.202111150900
-rw-r--r-- 1 nna nnacmd  22591549 Nov 15 09:10 nfcapd.202111150905
-rw-r--r-- 1 nna nnacmd  21770170 Nov 15 09:15 nfcapd.202111150910
-rw-r--r-- 1 nna nnacmd  21457947 Nov 15 09:20 nfcapd.202111150915
-rw-r--r-- 1 nna nnacmd  21656973 Nov 15 09:25 nfcapd.202111150920
-rw-r--r-- 1 nna nnacmd  20807670 Nov 15 09:30 nfcapd.202111150925
-rw-r--r-- 1 nna nnacmd  20947795 Nov 15 09:35 nfcapd.202111150930
-rw-r--r-- 1 nna nnacmd  21013289 Nov 15 09:40 nfcapd.202111150935
-rw-r--r-- 1 nna nnacmd  20426456 Nov 15 09:45 nfcapd.202111150940
-rw-r--r-- 1 nna nnacmd  22700936 Nov 15 09:50 nfcapd.202111150945
-rw-r--r-- 1 nna nnacmd  21636014 Nov 15 09:55 nfcapd.202111150950
-rw-r--r-- 1 nna nnacmd  21277852 Nov 15 10:00 nfcapd.202111150955
-rw-r--r-- 1 nna nnacmd  23671776 Nov 15 10:05 nfcapd.202111151000
-rw-r--r-- 1 nna nnacmd  20410279 Nov 15 10:10 nfcapd.202111151005
-rw-r--r-- 1 nna nnacmd  22221470 Nov 15 10:15 nfcapd.202111151010
-rw-r--r-- 1 nna nnacmd  20365819 Nov 15 10:20 nfcapd.202111151015
-rw-r--r-- 1 nna nnacmd  20917809 Nov 15 10:25 nfcapd.202111151020
-rw-r--r-- 1 nna nnacmd  21180554 Nov 15 10:30 nfcapd.202111151025
-rw-r--r-- 1 nna nnacmd  21854732 Nov 15 10:35 nfcapd.202111151030
-rw-r--r-- 1 nna nnacmd  21426545 Nov 15 10:40 nfcapd.202111151035
-rw-r--r-- 1 nna nnacmd  21940790 Nov 15 10:45 nfcapd.202111151040
-rw-r--r-- 1 nna nnacmd  20588673 Nov 15 10:50 nfcapd.202111151045
-rw-r--r-- 1 nna nnacmd  21759507 Nov 15 10:55 nfcapd.202111151050
-rw-r--r-- 1 nna nnacmd  21282014 Nov 15 11:00 nfcapd.202111151055
-rw-r--r-- 1 nna nnacmd  13249989 Nov 15 11:01 nfcapd.current.4248
-rw-r--r-- 1 nna users          0 Sep  7 15:34 nfcapd.current.60604
[root@netflow ~]#
ssax
Dreams In Code
Posts: 7682
Joined: Wed Feb 11, 2015 12:54 pm

Re: Top Talkers not displaying for similarly configured FWs

Post by ssax »

I know that these are generally needed on Cisco devices:

Code: Select all

collect timestamp absolute first
collect timestamp absolute last
You can use this command to make sure packets are showing up on the NNA server: (will even show packets blocked by the local firewall)
- Change X.X.X.X to the IP of the sending device

Code: Select all

tcpdump -nni any host X.X.X.X
You can use this to show the flows received in the last 5 minutes from that source:
- Change XXXXX to the source name

Code: Select all

nfdump -R /usr/local/nagiosna/var/XXXXX/flows -t '-300'
If the date/time is wrong on the flows, check the date/time on the sending device, or if a Cisco device, make sure those timestamp settings are on your flow configuration.

Please run that against your source and send me the output so I can review it.
nmfshqnetworkteam
Posts: 4
Joined: Mon Sep 27, 2021 9:08 am

Re: Top Talkers not displaying for similarly configured FWs

Post by nmfshqnetworkteam »

I know that these are generally needed on Cisco devices
collect timestamp absolute first
collect timestamp absolute last
These FPR devices are essentially Cisco ASAs with Firepower modules added on to them. For the layer 1-4 they act as ASAs. Given that, do you have a good resource on how to configure an ASA for use with Nagios Netflow Analyzer that I can vet my config against ? The working ASA/FPR does not have these two commands in it.
- Change X.X.X.X to the IP of the sending device
tcpdump shows data arriving at the Nagios collector
You can use this to show the flows received in the last 5 minutes from that source:
- Change XXXXX to the source name
This is interesting. Every time I ran this against this directory with a value of -300 or -5 even just to see if any output shows up, it gave me this error:

Code: Select all

[root@netflow flows]# pwd
/usr/local/nagiosna/var/ASHBURNINETFW1/flows
[root@netflow flows]# nfdump -R . -t '-30'
Time Window error: No time slot information available
When running this command against the 'working' ASA/FPR, it does display the flows.

The time on the Nagios collector and the ASA/FPR are in sync and accurate.

What could cause this error message?

And last ask of you: Are there any good resources on using nfdump to pull data manually, in instances when it isn't visible on the GUI? Like a cheat sheet that you guys use internally, or have access to, or can point to for your customers ?

Thanks for your help so far!
ssax
Dreams In Code
Posts: 7682
Joined: Wed Feb 11, 2015 12:54 pm

Re: Top Talkers not displaying for similarly configured FWs

Post by ssax »

I'm looking into the ASA/FPR config to see what I can find and will update shortly. Cisco TAC would be the proper source to get that information as we don't have access to any FRP devices/TAC.

The best I've found for nfdump documentation is here:

https://manpages.ubuntu.com/manpages/xe ... ump.1.html
http://nfdump.sourceforge.net/
https://github.com/phaag/nfdump

Try this:

Get the last non "current" flow file from this command:

Code: Select all

ls -ltr /usr/local/nagiosna/var/ASHBURNINETFW1/flows/ | tail -n2
Then use that flow file name in this command and PM the output:

Code: Select all

nfdump -r /usr/local/nagiosna/var/ASHBURNINETFW1/flows/nfcapd.XXXXXXXXXXXX -o raw
nmfshqnetworkteam
Posts: 4
Joined: Mon Sep 27, 2021 9:08 am

Re: Top Talkers not displaying for similarly configured FWs

Post by nmfshqnetworkteam »

Hello ssax,

I sent you a PM with the info you requested. Oddly though it seems to be in my Outbox, instead of Sent Items. I'm assuming this is a quirk of this board, but if you haven't seen the message yet in your inbox, please ping me so I can make it available to you some other way.

Thanks
benjaminsmith
Posts: 5324
Joined: Wed Aug 22, 2018 4:39 pm
Location: saint paul

Re: Top Talkers not displaying for similarly configured FWs

Post by benjaminsmith »

HI,

Can you try to send this once more? I believe your post count was not high enough to send a PM but should be now.

Thanks,
Benjamin
As of May 25th, 2018, all communications with Nagios Enterprises and its employees are covered under our new Privacy Policy.

Be sure to check out our Knowledgebase for helpful articles and solutions!
nmfshqnetworkteam
Posts: 4
Joined: Mon Sep 27, 2021 9:08 am

Re: Top Talkers not displaying for similarly configured FWs

Post by nmfshqnetworkteam »

Benjamin - I just did again. Please let me know if you have it now.

Thanks
ssax
Dreams In Code
Posts: 7682
Joined: Wed Feb 11, 2015 12:54 pm

Re: Top Talkers not displaying for similarly configured FWs

Post by ssax »

Received, thank you! It looks proper, I'm reaching out to another tech to see if he has any ideas.
Locked