sflow Source stops working

[jdalrymple]

*it won't help* but maybe a step to take would be to dump the data to a pcap file then feed it into sfcapd in a more "labby" type environment then maybe more data can be extracted from sfcapd during the crash.

Is there no chance of going this route? We would only need the data to be collected long enough to be ensured that a crash of sfcapd would have happened, so if your flow only lasts 10 minutes generally - 15 should be a good number.

If not, I think fiddling with those other parameters would be just that - 'fiddling' My initial thought would be to lower the metrics slightly from 1400 and 128 to maybe 1200 and 96 or some such.

[tgriep]

Is there any chance you can post the nfcap flow files for when the failure happens so we can view the data in them?

[nagios-retail]

Hello,

I've added the nfcap files from the last run when it stopped. In attachment you can find the files in a tar.gz file. (bzip2 format)

Best regards
Koen Beuselinck

[tgriep]

The data in the capture files look good. Do you know if these capture files were from before or after the upgrade you did to the NA server?

[nagios-retail]

Hi,

There were from after the upgrade.

[tgriep]

The only thing left to try is to recompile the nfdump software on your system and see if that works. Here is how to do that.

Code: Select all

cd /tmp
wget http://sourceforge.net/projects/nfdump/files/stable/nfdump-1.6.13/nfdump-1.6.13.tar.gz/download
tar xzf download
./configure --prefix=/usr/local --enable-sflow --enable-nsel
make
make install

[nagios-retail]

Hi,

I have made a snapshot of the vm and executed all the commands (did a reboot also) I will let you know the results later.

best regards
Koen

[tgriep]

Keep us posted.

[nagios-retail]

Hi,

Good news ! The sflow source doesn't interrupt anymore since my reboot yesterday evening. It seems that nfdump reinstallation is working . Can you tell me if the nfdump version we downloaded is the same version as the orginal ? It this something that we need to do if we reinstall the server for any reason ?

best regards
Koen

[tgriep]

That is good news.
To answer your question, nfdump-1.6.13 does come with the latest version of Network Analyzer but NSEL isn't compiled in it. The next version will have that enabled.
With the libc errors you were getting, it looks like the previous compile didn't work or some other package was updated causing a compatibility issue so it is hard to say what was causing it.