Nagios Support Forum

Support for Nagios products and services
https://support.nagios.com/forum/

unable to get information like 5 talkers in network analyzer

https://support.nagios.com/forum/viewtopic.php?t=53724

Page 1 of 3

unable to get information like 5 talkers in network analyzer

Posted: Fri May 03, 2019 12:16 pm
by rnjie
i recently setup network analyzer to integrate with my nagios xi for netflow monitoring, i did create a source group and i can see the data coming in but no talkers, any help with what am missing? see screenshot attached. am running the latest version of network analyzer NA 2.4.0

Re: unable to get information like 5 talkers in network anal

Posted: Fri May 03, 2019 1:05 pm
by benjaminsmith
Hello @rnjie,

This usually caused by time sync issues. You'll want to check and see if the time of the NNA server in in sync with the device that is sending the FLOW data. If they are out of sync, that will cause the issue you are seeing.

You can check the server time and php time settings by running the following commands:

Code: Select all

grep date.timezone /etc/php.ini
date

Re: unable to get information like 5 talkers in network anal

Posted: Fri May 03, 2019 1:59 pm
by rnjie
thank you but they are in sync, same time zone

Re: unable to get information like 5 talkers in network anal

Posted: Fri May 03, 2019 2:18 pm
by benjaminsmith
Hi @rnjie,

Let's check the Apache logs for errors. Can you run the following tail command:

Code: Select all

tail -f /var/log/httpd/*error_log /var/log/httpd/*access_log
Next, re-load the page and post the output of any errors.

Thanks.

Re: unable to get information like 5 talkers in network anal

Posted: Fri May 03, 2019 2:20 pm
by scottwilkerson
I'm pretty sure I've helped someone in the past with this error and the fix was to change the following in the /etc/php.ini

Code: Select all

max_execution_time = 90
Then restart httpd

Code: Select all

service httpd restart

Re: unable to get information like 5 talkers in network anal

Posted: Fri May 03, 2019 2:27 pm
by rnjie
this is the output of below command before and after reloading the webpage

==> /var/log/httpd/access_log <==
10.3.99.152 - - [03/May/2019:14:10:05 -0500] "POST /nagiosna/api/system/source_status HTTP/1.1" 200 169 "http://10.2.102.87/nagiosna/sources/queries/2" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36"
10.3.99.152 - - [03/May/2019:14:10:05 -0500] "POST /nagiosna/api/views/get_views HTTP/1.1" 200 2 "http://10.2.102.87/nagiosna/sources/queries/2" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36"
10.3.99.152 - - [03/May/2019:14:10:15 -0500] "POST /nagiosna/api/queries/read HTTP/1.1" 200 624 "http://10.2.102.87/nagiosna/sources/queries/2" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36"
10.3.99.152 - - [03/May/2019:14:10:19 -0500] "POST /nagiosna/api/queries/read HTTP/1.1" 200 257 "http://10.2.102.87/nagiosna/sources/queries/2" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36"
10.3.99.152 - - [03/May/2019:14:10:19 -0500] "POST /nagiosna/api/queries/execute HTTP/1.1" 200 106 "http://10.2.102.87/nagiosna/sources/queries/2" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36"
10.3.99.152 - - [03/May/2019:14:10:19 -0500] "POST /nagiosna/queries/queryviz HTTP/1.1" 200 6870 "http://10.2.102.87/nagiosna/sources/queries/2" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36"
10.3.99.152 - - [03/May/2019:14:10:19 -0500] "GET /nagiosna/api/graphs/queryviz?sid=2&qid=2&agg1=dstip&agg2=srcip&sortby=bytes HTTP/1.1" 200 65 "http://10.2.102.87/nagiosna/sources/queries/2" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36"
10.3.99.152 - - [03/May/2019:14:10:31 -0500] "POST /nagiosna/queries/queryviz HTTP/1.1" 200 6870 "http://10.2.102.87/nagiosna/sources/queries/2" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36"
10.3.99.152 - - [03/May/2019:14:10:31 -0500] "POST /nagiosna/api/queries/execute HTTP/1.1" 200 106 "http://10.2.102.87/nagiosna/sources/queries/2" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36"
10.3.99.152 - - [03/May/2019:14:10:31 -0500] "GET /nagiosna/api/graphs/queryviz?sid=2&qid=2&agg1=dstip&agg2=srcip&sortby=bytes HTTP/1.1" 200 65 "http://10.2.102.87/nagiosna/sources/queries/2" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36"
10.3.99.152 - - [03/May/2019:14:22:43 -0500] "POST /nagiosna/index.php/api/system/cpu_status HTTP/1.1" 200 15 "http://10.2.102.83/nagiosxi/config/moni ... wizard=nna" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36"
10.3.99.152 - - [03/May/2019:14:22:43 -0500] "POST /nagiosna/index.php/api/sources/read HTTP/1.1" 200 175 "http://10.2.102.83/nagiosxi/config/moni ... wizard=nna" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36"
10.3.99.152 - - [03/May/2019:14:22:43 -0500] "POST /nagiosna/index.php/api/views/get_views HTTP/1.1" 200 2 "http://10.2.102.83/nagiosxi/config/moni ... wizard=nna" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36"
10.3.99.152 - - [03/May/2019:14:22:52 -0500] "POST /nagiosna/index.php/api/graphs/execute HTTP/1.1" 200 5716 "http://10.2.102.83/nagiosxi/config/monitoringwizard.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36"
10.3.99.152 - - [03/May/2019:14:23:13 -0500] "POST /nagiosna/index.php/api/system/cpu_status HTTP/1.1" 200 17 "http://10.2.102.83/nagiosxi/config/monitoringwizard.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36"
10.3.99.152 - - [03/May/2019:14:23:13 -0500] "POST /nagiosna/index.php/api/sources/read HTTP/1.1" 200 175 "http://10.2.102.83/nagiosxi/config/monitoringwizard.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36"
10.3.99.152 - - [03/May/2019:14:23:13 -0500] "POST /nagiosna/index.php/api/views/get_views HTTP/1.1" 200 2 "http://10.2.102.83/nagiosxi/config/monitoringwizard.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36"
10.3.99.152 - - [03/May/2019:14:26:05 -0500] "GET /nagiosna/sources/queries/2 HTTP/1.1" 200 44764 "http://10.2.102.87/nagiosna/sources/percentile/2" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36"
10.3.99.152 - - [03/May/2019:14:26:05 -0500] "GET /nagiosna/media/favicon.ico HTTP/1.1" 200 822 "http://10.2.102.87/nagiosna/sources/queries/2" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36"
10.3.99.152 - - [03/May/2019:14:26:05 -0500] "POST /nagiosna/api/system/source_status HTTP/1.1" 200 169 "http://10.2.102.87/nagiosna/sources/queries/2" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36"
10.3.99.152 - - [03/May/2019:14:26:05 -0500] "POST /nagiosna/api/views/get_views HTTP/1.1" 200 2 "http://10.2.102.87/nagiosna/sources/queries/2" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36"
10.3.99.152 - - [03/May/2019:14:26:06 -0500] "GET /nagiosna/sources/queries/2 HTTP/1.1" 200 44764 "http://10.2.102.87/nagiosna/sources/percentile/2" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36"
10.3.99.152 - - [03/May/2019:14:26:07 -0500] "GET /nagiosna/media/favicon.ico HTTP/1.1" 200 822 "http://10.2.102.87/nagiosna/sources/queries/2" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36"
10.3.99.152 - - [03/May/2019:14:26:07 -0500] "POST /nagiosna/api/system/source_status HTTP/1.1" 200 169 "http://10.2.102.87/nagiosna/sources/queries/2" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36"
10.3.99.152 - - [03/May/2019:14:26:07 -0500] "POST /nagiosna/api/views/get_views HTTP/1.1" 200 2 "http://10.2.102.87/nagiosna/sources/queries/2" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36"
10.3.99.152 - - [03/May/2019:14:26:13 -0500] "GET /nagiosna/sources/queries/2 HTTP/1.1" 200 44764 "http://10.2.102.87/nagiosna/sources/percentile/2" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36"
10.3.99.152 - - [03/May/2019:14:26:13 -0500] "GET /nagiosna/media/favicon.ico HTTP/1.1" 200 822 "http://10.2.102.87/nagiosna/sources/queries/2" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36"
10.3.99.152 - - [03/May/2019:14:26:13 -0500] "POST /nagiosna/api/system/source_status HTTP/1.1" 200 169 "http://10.2.102.87/nagiosna/sources/queries/2" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36"
10.3.99.152 - - [03/May/2019:14:26:13 -0500] "POST /nagiosna/api/views/get_views HTTP/1.1" 200 2 "http://10.2.102.87/nagiosna/sources/queries/2" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36"
10.3.99.152 - - [03/May/2019:14:26:16 -0500] "GET /nagiosna/sources/queries/2 HTTP/1.1" 200 44764 "http://10.2.102.87/nagiosna/sources/percentile/2" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36"
10.3.99.152 - - [03/May/2019:14:26:16 -0500] "GET /nagiosna/media/favicon.ico HTTP/1.1" 200 822 "http://10.2.102.87/nagiosna/sources/queries/2" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36"
10.3.99.152 - - [03/May/2019:14:26:16 -0500] "POST /nagiosna/api/system/source_status HTTP/1.1" 200 169 "http://10.2.102.87/nagiosna/sources/queries/2" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36"
10.3.99.152 - - [03/May/2019:14:26:16 -0500] "POST /nagiosna/api/views/get_views HTTP/1.1" 200 2 "http://10.2.102.87/nagiosna/sources/queries/2" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36"

Re: unable to get information like 5 talkers in network anal

Posted: Fri May 03, 2019 2:38 pm
by scottwilkerson
Did you change the max_execution_time ?
scottwilkerson wrote:I'm pretty sure I've helped someone in the past with this error and the fix was to change the following in the /etc/php.ini

Code: Select all

max_execution_time = 90
Then restart httpd

Code: Select all

service httpd restart

Re: unable to get information like 5 talkers in network anal

Posted: Fri May 03, 2019 2:48 pm
by cdienger
I'd also review the nfcapd files the data is stored in to make sure the timestamp is correct in them. This can be done by navigating to the sources directory (/usr/local/nagiosna/var/SOURCENAME/flows) and running the nfdump command on the latest nfcapd files:

nfdump -r nfcapd.TIMESTAMP

Re: unable to get information like 5 talkers in network anal

Posted: Mon May 06, 2019 9:54 am
by rnjie
yes i did change the max execution time to 90 and restarted http and nothing changed, when i ran the nfdump command on the latest timestamp this is what i get

Summary: total flows: 4641, total bytes: 7281432, total packets: 20102, avg bps: 0, avg pps: 0, avg bpp: 0
Time window: 2019-05-06 04:00:00 - 2019-05-06 04:05:00
Total flows processed: 4641, Blocks skipped: 0, Bytes read: 371408
Sys: 0.036s flows/second: 125575.0 Wall: 0.198s flows/second: 23377.2

Re: unable to get information like 5 talkers in network anal

Posted: Mon May 06, 2019 10:01 am
by rnjie
okay noe i just noticed that there wasnt any flow of data during the weekend, it stopped sending flows on the friday 5/3/2019, so now i do not have both the low data and talkers. the only changes i did on friday was the max execution to 90.
All times are UTC-05:00
Page 1 of 3

Powered by phpBB® Forum Software © phpBB Limited