Page 1 of 1
Not seeing packets on ASA sources
Posted: Wed Jul 22, 2015 12:19 pm
by pythiangrp
I am working on updating and getting better configurations from Nagios NNA and the integration with Nagios XI.
Thus far, I have added many of my Cisco ASA hosts, as well as a couple of linux servers and routers.
All hosts are properly reporting bandwitdh graphs for the Bytes, Flows and Bytes/sec, but the ASA devices are not reporting back packets. If I filter the graph on Packets, it is blank. As well, I am not seeing any information in the Top Talkers area of the graph.
I have attached two graphs showing this on a 5540, but I am seeing the same results with a 5520, some 5510 and a 5505.
Any assistance is greatly appreciated.
Andre
5540-Bandwidth.PNG
5540-NoPackets.PNG
Re: Not seeing packets on ASA sources
Posted: Wed Jul 22, 2015 12:24 pm
by jolson
You will need to recompile nfcapd with NSEL support. Follow this procedure:
Code: Select all
cd /tmp
wget http://sourceforge.net/projects/nfdump/files/stable/nfdump-1.6.13/nfdump-1.6.13.tar.gz/download
tar xzf download
cd nfdump-1.6.13/
./configure --enable-sflow --enable-nsel
make
make install
EDIT: After the procedure, you'll want to restart your sources:
service nagiosna restart
Re: Not seeing packets on ASA sources
Posted: Thu Jul 23, 2015 11:29 am
by pythiangrp
I recompiled nfcapd as suggested, and am now very happy to say that I can see the top talkers, run queries, etc... without issue.
That being said, when looking at the bandwidth graphs, it is still not reporting the number of packets, which I would like to have, if possible.
At first, I figured it was a timing issue, so after making the changes yesterday afternoon, I let it sit, but even now, about 20+ hours later, still not seeing the packets in the graphs.
Thanks,
Andre
NoPackets.PNG
Re: Not seeing packets on ASA sources
Posted: Thu Jul 23, 2015 11:33 am
by ssax
The ASA software doesn't send the number of packets in the data (I've verified this with a packet capture), I'm unsure if Cisco provides an updated firmware that would fix it, your best bet would be to call them and ask them and let us know their answer if you have support with them.
Re: Not seeing packets on ASA sources
Posted: Fri Jul 24, 2015 9:51 am
by pythiangrp
Thanks for the information about the packets.
Given that Cisco is not supplying them, all is good on my end, and if this needs to be marked as closed, it can.
Thanks!
Andre
Re: Not seeing packets on ASA sources
Posted: Fri Jul 24, 2015 9:53 am
by tmcdonald
That's our standard procedure, lock a thread when it's done. I'll do that, but if you hear anything from Cisco feel free to PM me and I will open it back up for your findings.