Page 4 of 5
Re: sflow Source stops working
Posted: Fri Apr 17, 2015 1:29 pm
by jdalrymple
jdalrymple wrote:*it won't help* but maybe a step to take would be to dump the data to a pcap file then feed it into sfcapd in a more "labby" type environment then maybe more data can be extracted from sfcapd during the crash.
Is there no chance of going this route? We would only need the data to be collected long enough to be ensured that a crash of sfcapd would have happened, so if your flow only lasts 10 minutes generally - 15 should be a good number.
If not, I think fiddling with those other parameters would be just that - 'fiddling' My initial thought would be to lower the metrics slightly from 1400 and 128 to maybe 1200 and 96 or some such.
Re: sflow Source stops working
Posted: Fri Apr 17, 2015 1:37 pm
by tgriep
Is there any chance you can post the nfcap flow files for when the failure happens so we can view the data in them?
Re: sflow Source stops working
Posted: Wed May 13, 2015 10:22 am
by nagios-retail
Hello,
I've added the nfcap files from the last run when it stopped. In attachment you can find the files in a tar.gz file. (bzip2 format)
Best regards
Koen Beuselinck
Re: sflow Source stops working
Posted: Wed May 13, 2015 2:01 pm
by tgriep
The data in the capture files look good. Do you know if these capture files were from before or after the upgrade you did to the NA server?
Re: sflow Source stops working
Posted: Thu May 21, 2015 4:09 am
by nagios-retail
Hi,
There were from after the upgrade.
Re: sflow Source stops working
Posted: Thu May 21, 2015 4:58 pm
by tgriep
The only thing left to try is to recompile the nfdump software on your system and see if that works. Here is how to do that.
Code: Select all
cd /tmp
wget http://sourceforge.net/projects/nfdump/files/stable/nfdump-1.6.13/nfdump-1.6.13.tar.gz/download
tar xzf download
./configure --prefix=/usr/local --enable-sflow --enable-nsel
make
make install
Re: sflow Source stops working
Posted: Tue Jun 02, 2015 10:16 am
by nagios-retail
Hi,
I have made a snapshot of the vm and executed all the commands (did a reboot also) I will let you know the results later.
best regards
Koen
Re: sflow Source stops working
Posted: Tue Jun 02, 2015 11:08 am
by tgriep
Keep us posted.
Re: sflow Source stops working
Posted: Wed Jun 03, 2015 2:03 am
by nagios-retail
Hi,
Good news ! The sflow source doesn't interrupt anymore since my reboot yesterday evening. It seems that nfdump reinstallation is working . Can you tell me if the nfdump version we downloaded is the same version as the orginal ? It this something that we need to do if we reinstall the server for any reason ?
best regards
Koen
Re: sflow Source stops working
Posted: Wed Jun 03, 2015 9:38 am
by tgriep
That is good news.
To answer your question, nfdump-1.6.13 does come with the latest version of Network Analyzer but NSEL isn't compiled in it. The next version will have that enabled.
With the libc errors you were getting, it looks like the previous compile didn't work or some other package was updated causing a compatibility issue so it is hard to say what was causing it.