No Data Available

[WillemDH]

Hello,

Updated our NNA to 2R1.0 today. We have not used the NNA over the last year.
I'm trying to send sflow to our NNA from a Windows Server. I installed https://github.com/sflow/host-sflow on the server and configured it to send sflow over port 6343.

tcpdump shows the data 'flowing' in:


But 'no data available'. Please advise how to make it graph.

[ssax]

If you edit the source did you select sFlow for the Incoming Flow Type?

If yes, then lets take a look at the packets, run this command:

Code: Select all

tcpdump -ni eth0 -s0 -w /tmp/capture.pcap dst port 6343

Then PM the /tmp/capture.pcap file so that we can open it up in Wireshark and do Analyze > Decode As > sFlow to see what data is being sent.

[WillemDH]

Damn it was configured as Netflow. Thought I configured Sflow. As I could not edit the flow type (greyed out) I deleted and recreated the source, but I'm still not getting any data it seems.

And then it started working. One more issue. I cant seem to configure a different port then 6343 with the Windows Flow Probe. I can't send different hosts to the same source in nna. What agent are you sing for WIndows servers?

[ssax]

I'll leave it open for the other techs to chime in on as I'm not really familiar with the windows sFlow agents.

One thing that might work would be for you to use an iptables redirect to change the port:

Code: Select all

iptables -t nat -I PREROUTING --src WINDOWSSOURCEIP --dst NNASERVERIP -p udp --dport 6343 -j REDIRECT --to-ports 6344

Taken from here:

http://www.cyberciti.biz/faq/linux-port ... -iptables/

[WillemDH]

I'd prefer to choose the port client side if possible. Noone with experience with Flow probes on Windows?

[tgriep]

Take a look at this link for a couple of Windows Flow Exporters that look like the sending ports can be modified.
https://assets.nagios.com/downloads/nag ... alyzer.pdf

[WillemDH]

Seems like I discovered a bug with NNA. I have seen it multiple times that although I configured sFlow and the gui shows sFlow in Sources, when I go to the source and choose edit, it suddenly says NetFlow.
This should be reproducable. I have this one source where I don't seem to be able to choose sflow. Every time I save, it is changed to Netflow....
It is also not possible to change the flow type after creation.

I tried the FlowTracq Exporter, but it doesn't seem to start send the flows to NNA. I did manage to make the Host sFlow Exporter send to a specific port, as I can see the flows coming in with tcpdump, but NNA still shows no data. It might be related to the above described bug, as when I edit settings, it says netFlow instead of sFlow...

[scottwilkerson]

Seems like I discovered a bug with NNA. I have seen it multiple times that although I configured sFlow and the gui shows sFlow in Sources, when I go to the source and choose edit, it suddenly says NetFlow.
This should be reproducable. I have this one source where I don't seem to be able to choose sflow. Every time I save, it is changed to Netflow....
It is also not possible to change the flow type after creation.

I tried the FlowTracq Exporter, but it doesn't seem to start send the flows to NNA. I did manage to make the Host sFlow Exporter send to a specific port, as I can see the flows coming in with tcpdump, but NNA still shows no data. It might be related to the above described bug, as when I edit settings, it says netFlow instead of sFlow...

I can confirm this is a bug and have opened an internal but report TASK ID 7117

I am attaching a fix for you, you can unzip the following and place in
/var/www/html/nagiosna/application/views/sources/

[WillemDH]

Thanks for the 'but report' Scott! I'll test the fix tomorrow.

[scottwilkerson]

Let us know if you have any issues.

Thx